CVE-2026-67318
Received Received - Intake

HTTP/2 Streamed Request Body Bypass in Axios

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67318
EUVD
EUVD-2026-51826

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
axios axios From 1.13.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects axios versions 1.13.0 and later when using the Node.js HTTP adapter. It fails to enforce the maxBodyLength limit on streamed request bodies sent with HTTP/2. Attackers can exploit this by controlling a stream passed to axios to transmit excessive data beyond the configured limit, causing resource consumption and policy bypass.

Detection Guidance

Detecting this vulnerability requires checking if your axios version is >=1.13.0 and if HTTP/2 requests are being made with streamed bodies. Inspect package.json for axios version and review HTTP/2 request handling code. No specific commands are provided for detection.

Impact Analysis

The impact includes resource consumption, excess egress, upstream quota consumption, and limited availability. It does not allow code execution, credential disclosure, or control over request destinations. Only applications using HTTP/2 with maxBodyLength set to a finite value and maxRedirects set to 0 are affected.

Mitigation Strategies

Upgrade axios to a version that enforces maxBodyLength for HTTP/2 requests. If upgrading is not possible, avoid using HTTP/2 with streamed bodies or set maxBodyLength to -1 (unlimited). Review outbound data policies to limit resource consumption impacts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart