CVE-2026-67318: Axios HTTP/2 DOS Vulnerability

CVE-2026-67318 Overview

CVE-2026-67318 affects the axios HTTP client library for Node.js at versions >=1.13.0. The Node.js HTTP adapter fails to enforce the configured maxBodyLength limit on streamed request bodies when requests use httpVersion: 2. Node's HTTP/2 request API does not honor the maxBodyLength option, and the axios byte-counting stream wrapper is gated on maxRedirects === 0. An attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite limit. The flaw is categorized as uncontrolled resource consumption [CWE-400].

Critical Impact
Attackers controlling an input stream can bypass configured request body size limits over HTTP/2, driving excess egress, upstream quota consumption, and limited availability degradation.

Affected Products

axios versions >=1.13.0 (Node.js HTTP adapter)
Applications calling axios with httpVersion: 2 and a finite maxBodyLength
Server-side Node.js applications passing attacker-influenced streams to axios

Discovery Timeline

2026-08-01 - CVE-2026-67318 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67318

Vulnerability Analysis

The axios library exposes a maxBodyLength configuration option to cap the size of outbound request bodies. In the Node.js HTTP adapter, enforcement of that cap for streamed bodies depends on an internal byte-counting stream wrapper. When callers opt into HTTP/2 by setting httpVersion: 2, the underlying Node.js HTTP/2 client API does not honor the maxBodyLength option, so the transport layer does not enforce the limit.

The axios-level guard that would otherwise count bytes and abort oversized transfers is only wired in when maxRedirects === 0. In typical configurations that permit redirects, the guard is bypassed entirely. The result is that streamed request bodies over HTTP/2 flow to the destination without size enforcement.

Impact is limited to resource consumption and policy bypass. The vulnerability does not enable code execution, credential disclosure, or attacker control over request destinations. Calls using the default maxBodyLength: -1 and browser adapters are not affected.

Root Cause

The root cause is a missing enforcement path in the HTTP/2 code path of the axios Node.js adapter. The maxBodyLength policy is expressed at the library boundary but not propagated to Node's HTTP/2 request implementation. The compensating stream wrapper that would enforce the limit is gated on a maxRedirects === 0 condition, leaving the default and common configurations unprotected.

Attack Vector

Exploitation requires an attacker to control or influence a stream that the target application passes to axios as a request body. The application must be configured with httpVersion: 2 and a finite maxBodyLength. The attacker supplies a stream that produces significantly more bytes than the configured cap. Axios transmits the entire stream over HTTP/2, causing excess outbound bandwidth use, upstream quota consumption, or limited availability effects on the calling service.

The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-mwf2-3pr3-8698 and the VulnCheck Advisory.

Detection Methods for CVE-2026-67318

Indicators of Compromise

Outbound HTTP/2 requests from Node.js services with body sizes far exceeding documented application limits.
Sudden increases in egress bandwidth or upstream API quota consumption tied to a single service or endpoint.
Application logs showing axios requests configured with httpVersion: 2 and non-default maxBodyLength values that appear to be exceeded.

Detection Strategies

Inventory Node.js dependencies to identify services using axios >=1.13.0 with httpVersion: 2 and finite maxBodyLength.
Instrument axios call sites to log request body byte counts and compare against the configured cap.
Correlate outbound network telemetry with application-level request logs to identify body size anomalies.

Monitoring Recommendations

Alert on sustained egress spikes from services that historically issue small requests.
Track upstream API rate-limit and quota exhaustion events that correlate with specific caller services.
Monitor process-level network I/O metrics for Node.js workloads and baseline typical request body sizes.

How to Mitigate CVE-2026-67318

Immediate Actions Required

Upgrade axios to a patched release once available from the maintainers; consult the axios security advisory for the fixed version.
Audit all call sites that combine httpVersion: 2 with a finite maxBodyLength and validate stream sources.
Restrict which streams can be passed as request bodies; do not forward attacker-controlled streams without size validation upstream.

Patch Information

Refer to the GitHub Security Advisory GHSA-mwf2-3pr3-8698 for the affected version range and fixed release information. The VulnCheck Advisory provides additional context on the enforcement gap in the HTTP/2 code path.

Workarounds

Avoid httpVersion: 2 in axios until the library is upgraded; use the default HTTP/1.1 transport where maxBodyLength is enforced.
Pre-validate stream length before passing it to axios, using a wrapper stream that aborts when a configured byte threshold is exceeded.
Enforce egress size limits at the network layer, such as via an outbound proxy that caps request body size for known upstream destinations.

bash

# Configuration example: pin axios to a non-vulnerable version once released
npm install axios@<patched-version>