Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
- Severity:
- Medium
Description
axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.7.0, < 1.18.0
- Patched version(s): 1.18.0
References
Related Issues
- Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
- Axios: HTTP/2 streamed uploads bypass `maxBodyLength` - Vulnerability
- Axios: HTTP adapter streamed responses bypass maxContentLength - CVE-2026-42036
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - Vulnerability
You might also like:
- Tags:
- npm
- axios
Anything's wrong? Let us know Last updated on July 20, 2026