CVE-2026-42034: Axios HTTP Adapter Streamed Uploads Bypass Max Body Length
Summary
CVE-2026-42034: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0. Affects axios across 2 version ranges.
< 0.31.1
>= 1.0.0, < 1.15.1
Fixed in 0.31.1 or 1.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular promise-based HTTP client for JavaScript, designed to make it easier to send asynchronous HTTP requests to REST endpoints and perform CRUD operations. It supports features like request and response interception, automatic JSON data transformation, and the ability to cancel requests. However, a vulnerability exists in its handling of streamed uploads when certain configurations are applied, which can lead to unintended consequences.
Vulnerability Detail
The vulnerability arises from a flaw in Axios' handling of streamed request bodies. When the 'maxRedirects' option is set to 0, the library bypasses the 'maxBodyLength' restriction, allowing oversized streamed uploads to be sent without enforcement of the specified limits. This can lead to Denial of Service (DoS) attacks, uncontrolled upstream uploads, and resource exhaustion on the server side. The issue is rooted in the way Axios interacts with the native HTTP/HTTPS transport, where the checks for 'maxBodyLength' do not apply to streamed data, creating a path-specific bypass.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.31.10.31.1npm install axios@0.31.1 -
>= 1.0.0, < 1.15.11.15.1npm install axios@1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid setting 'maxRedirects' to 0 when using streamed request bodies. Instead, use a non-zero value for 'maxRedirects' to ensure that the 'maxBodyLength' enforcement is applied correctly.
Conclusion
In summary, CVE-2026-42034 presents a significant risk for applications using Axios with streamed uploads when configured with 'maxRedirects: 0'. It is crucial to update to the latest versions or implement workarounds to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for axios →
FAQ
The vulnerability can lead to Denial of Service (DoS) attacks, uncontrolled uploads, and resource exhaustion on the server.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Versions of Axios prior to 1.15.1 and 0.31.1 are affected by this vulnerability.
Yes, avoid using 'maxRedirects: 0' when sending streamed request bodies to enforce 'maxBodyLength'.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
