Bypass of maxBodyLength in Axios Fetch Adapter: Uncontrolled Stream Uploads
Summary
GHSA-jqh4-m9w3-8hp9: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength. Affects axios versions >= 1.7.0, < 1.18.0. Fixed in 1.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both Node.js and browser environments. It provides a simple API for handling requests and responses, making it a go-to choice for developers. The library includes a fetch adapter for environments where the native fetch API is available. However, a recent vulnerability has been identified in the fetch adapter that allows untrusted upload streams to bypass the configured maximum body length, potentially leading to unexpected network egress and resource exhaustion.
Vulnerability Detail
The vulnerability arises from the fetch adapter's failure to enforce the maxBodyLength limit for live WHATWG ReadableStream request bodies. When an application uses the fetch adapter and relies on maxBodyLength to restrict untrusted uploads, it can inadvertently send the entire stream, even if it exceeds the specified limit. This can lead to uncontrolled data egress, resource consumption, and potential exhaustion of API quotas or bandwidth. The issue is rooted in the lack of a branch in the body-length resolution logic for ReadableStream, which results in the maxBodyLength check being skipped for unknown-length streams.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.0
This is the first release that contains the fix.
npm install axios@1.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, use the HTTP adapter for untrusted stream uploads in Node.js environments. Alternatively, you can wrap or count the stream at the application layer and abort it when it exceeds the intended limit. Here is an example of how to implement a simple stream wrapper that checks the byte length:
function limitStream(stream, maxBytes) {
let totalBytes = 0;
return new ReadableStream({
pull(controller) {
if (totalBytes >= maxBytes) {
controller.close();
return;
}
stream.getReader().read().then(({ done, value }) => {
if (done) {
controller.close();
return;
}
totalBytes += value.byteLength;
controller.enqueue(value);
});
}
});
}
Conclusion
The Axios fetch adapter vulnerability allows untrusted streams to bypass the maxBodyLength limit, posing risks of uncontrolled data egress and resource exhaustion. Updating to version 1.18.0 or later is essential to mitigate this issue. Until then, using workarounds like the HTTP adapter or stream wrappers can help manage the risk.
See every vulnerability recorded for axios →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
Axios versions from 1.7.0 up to, but not including, 1.18.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to uncontrolled data egress, resource exhaustion, and bypassing of API quotas or bandwidth limits, which can impact application performance and costs.
Yes, you can use the HTTP adapter for untrusted stream uploads or implement a stream wrapper that limits the byte length of the upload.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
