Uncontrolled Resource Consumption
CVE-2026-67318
Summary
axios versions from 1.13.0 prior to 1.18.0 (Node.js HTTP adapter) fail to enforce the configured 'maxBodyLength' limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the 'maxBodyLength' option and axios's byte-counting stream wrapper is gated on 'maxRedirects === 0', an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite 'maxBodyLength'. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default 'maxBodyLength: -1' and browser adapters are not affected.
- LOW
- NETWORK
- NONE
- NONE
CWE-400 - Uncontrolled resource consumption
An uncontrolled resource allocation attack (also known as resource exhaustion attack) triggers unauthorized overconsumption of the limited resources in an application, such as memory, file system storage, database connection pool entries, and CPU. This may lead to denial of service for valid users and degradation of the application's functionality as well as that of the host operating system.
References
Advisory Timeline
- Published
