Description
Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.
This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.13.0, < 1.18.0
- Patched version(s): 1.18.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: HTTP/2 streamed uploads bypass `maxBodyLength` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
- Axios: HTTP adapter streamed responses bypass maxContentLength - CVE-2026-42036
- Axios form serializer maxDepth bypass via {} metatoken - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026