PT-2026-67298 · Npm · Axios
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L |
Name of the Vulnerable Software and Affected Versions
axios versions 1.13.0 and later
Description
When using the Node.js HTTP adapter, the software fails to enforce the
maxBodyLength limit on streamed request bodies if the requests are sent with httpVersion: 2. This occurs because the Node.js HTTP/2 request API does not honor the maxBodyLength option, and the internal byte-counting stream wrapper is only activated when maxRedirects is set to 0.An attacker who controls a stream passed to the software can cause the application to transmit outbound data that exceeds the configured finite
maxBodyLength. This can lead to resource consumption and policy bypass, such as excess outbound bandwidth, increased egress costs, upstream quota consumption, and limited availability of the application or upstream peer. This issue does not allow for code execution, credential disclosure, or request-destination control.Recommendations
For versions 1.15.1 and later, set
maxRedirects: 0 on affected HTTP/2 streamed upload calls to activate the stream wrapper and reject oversized streams.
For versions prior to 1.15.1, pre-limit the stream with a byte-counting transform before passing it to the software, reject oversized uploads before forwarding them, or avoid using httpVersion: 2 for untrusted streamed uploads.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Axios