CVE-2026-67317 in axios
Summary
by MITRE • 08/01/2026
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
The vulnerability identified in axios versions 1.7.0 through 1.17.9 represents a critical security flaw in the fetch adapter implementation that specifically affects how the library handles WHATWG ReadableStream request bodies. This issue stems from the library's inability to properly enforce maximum body length restrictions when dealing with stream data that lacks determinable content length information. The flaw exists within the network request processing pipeline where axios attempts to manage streaming data through the fetch API, creating a scenario where upload size limits become ineffective barriers against excessive data transfer.
The technical nature of this vulnerability manifests when axios encounters a WHATWG ReadableStream that cannot provide a Content-Length header or similar definitive size indicator. In such cases, the library's maxBodyLength enforcement mechanism fails to properly monitor and restrict the stream's data flow, allowing attackers to transmit arbitrarily large amounts of data through the network connection without triggering the intended size limits. This behavior occurs specifically in the fetch adapter implementation rather than other axios transport mechanisms, making it a targeted issue within the library's architecture.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions to encompass potential resource exhaustion and unauthorized data exfiltration scenarios. Attackers can leverage this flaw to bypass upload restrictions that are typically implemented to prevent excessive network egress or system resource consumption, potentially leading to service disruption, increased bandwidth costs, or even complete system compromise if the underlying infrastructure lacks proper monitoring of outgoing traffic volumes.
This vulnerability aligns with CWE-400, which addresses "Uncontrolled Resource Consumption" and specifically relates to the improper handling of stream data in network request processing. The flaw also connects to ATT&CK technique T1071.004, which covers "Application Layer Protocol: DNS," as attackers may use this capability to establish persistent data exfiltration channels through network protocols that are not properly constrained by size limitations. Additionally, the issue demonstrates characteristics of CWE-1287, "Improper Enforcement of Upload Size Limits," where protective measures against excessive file or data uploads fail to function correctly in edge cases involving streaming data.
Organizations utilizing affected axios versions should immediately implement mitigations including updating to the patched versions 1.18.0 and later, implementing additional network-level restrictions on upload sizes, and monitoring for unusual outbound traffic patterns that might indicate exploitation attempts. System administrators should also consider implementing application firewalls or load balancer rules that can enforce size limits at the network boundary rather than relying solely on client-side library protections. The vulnerability demonstrates the importance of comprehensive testing for edge cases in streaming data handling and highlights the critical need for proper resource management even when dealing with asynchronous stream operations.