CVE-2026-67317: axios <1.18.0 bypass maxBodyLength via unknown stream size
CVE-2026-67317 Published on August 1, 2026
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Products Associated with CVE-2026-67317
Want to know whenever a new CVE is published for Axios? stack.watch will email you.
Affected Versions
axios:- Version 1.7.0 and below 1.18.0 is affected.
- Version 1.18.0 is unaffected.