CVE-2026-67317: Axios DOS Vulnerability in Stream Handling

CVE-2026-67317 Overview

CVE-2026-67317 affects the axios HTTP client library for JavaScript, specifically versions 1.7.0 through 1.17.x. The vulnerability resides in the fetch adapter, which fails to enforce the maxBodyLength configuration option when a request body is provided as a WHATWG ReadableStream and the Content-Length header cannot be determined. Attackers who control stream data can bypass upload size limits, causing uncontrolled network egress or resource exhaustion on hosts that use axios to relay client-supplied streams. The issue is classified under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Applications relying on maxBodyLength to bound outbound uploads can be forced to transmit arbitrarily large stream payloads, exhausting bandwidth, memory, or downstream service quotas.

Affected Products

axios versions 1.7.0 through 1.17.x (fetch adapter)
Node.js and browser applications using axios ReadableStream request bodies
Server-side proxies and upload services built on affected axios releases

Discovery Timeline

2026-08-01 - CVE-2026-67317 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67317

Vulnerability Analysis

Axios exposes the maxBodyLength option so callers can cap the size of outbound request bodies. In affected releases, the fetch adapter enforces this cap only when it can determine the body length ahead of time, for example from a Buffer, string, or a stream that reports a Content-Length. When the caller supplies a WHATWG ReadableStream whose length is unknown, the adapter proceeds without wrapping the stream in a counting or limiting transform. The request then streams to completion regardless of how many bytes flow through it.

The result is a resource-limits failure rather than a memory-safety issue. Availability of the axios host and downstream targets is affected, while confidentiality and integrity are not directly impacted. Applications that trust maxBodyLength as a defensive boundary against oversized uploads inherit that missing enforcement.

Root Cause

The fetch adapter's size-check branch treats an indeterminate length as "no limit needed" instead of "apply the limit while streaming." No wrapping stream tracks cumulative bytes against maxBodyLength, so the check is silently skipped for ReadableStream inputs without Content-Length.

Attack Vector

An attacker needs to influence the body of an axios request issued by a vulnerable application, typically by controlling an upstream upload that the application forwards using a ReadableStream. By sending an unbounded or very large stream, the attacker forces the axios client to transmit far more data than the configured maxBodyLength should permit. This can be used to exhaust bandwidth, disk, or provider quotas, or to abuse the vulnerable host as an amplifier against a downstream endpoint. Refer to the GitHub Security Advisory GHSA-jqh4-m9w3-8hp9 and the Vulncheck advisory for maintainer analysis.

No verified public proof-of-concept code is available. See the linked
advisories for maintainer-provided technical details.

Detection Methods for CVE-2026-67317

Indicators of Compromise

Outbound axios requests whose transmitted byte counts significantly exceed the application's configured maxBodyLength value.
Sustained high-volume egress from Node.js services that proxy user-supplied uploads through the fetch adapter.
Downstream services logging request bodies far larger than the upstream application should permit.

Detection Strategies

Inventory Node.js and browser applications for axios versions between 1.7.0 and 1.17.x using software composition analysis or npm ls axios.
Audit source code for axios calls that pass a ReadableStream as data without an explicit Content-Length header.
Correlate egress traffic volume with application-level upload limits to identify enforcement gaps.

Monitoring Recommendations

Alert on Node.js processes exceeding baseline outbound bandwidth or connection duration for upload endpoints.
Track EPSS movement for CVE-2026-67317 (currently 0.359%, percentile 28.584) to prioritize follow-up as exploit likelihood changes.
Log and rate-limit forwarded uploads at a reverse proxy or API gateway to catch size-limit bypasses independently of the library.

How to Mitigate CVE-2026-67317

Immediate Actions Required

Upgrade axios to version 1.18.0 or later in all affected Node.js and browser projects.
Rebuild and redeploy container images, serverless bundles, and client artifacts that pin an affected axios release.
Review services that forward user-supplied streams through axios and add independent size enforcement.

Patch Information

The axios maintainers addressed CVE-2026-67317 in version 1.18.0. The fix ensures maxBodyLength is enforced for ReadableStream bodies even when Content-Length is not available. See the GitHub Security Advisory GHSA-jqh4-m9w3-8hp9 for the maintainer notes and fix commits.

Workarounds

Avoid passing raw ReadableStream bodies to axios until upgrading; buffer the payload or use a stream that reports Content-Length.
Switch to the default XHR or HTTP adapter where feasible, since the flaw is specific to the fetch adapter path.
Enforce upload size limits at an upstream layer such as an API gateway, reverse proxy, or WAF so bypass of maxBodyLength does not translate into unbounded egress.

bash

# Upgrade axios to a fixed release
npm install axios@^1.18.0

# Verify no affected version remains in the dependency tree
npm ls axios