Description
When responseType: ‘stream’ is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **<= 0.31.0 >= 1.0.0, < 1.15.1** Patched version(s): **0.31.1 1.15.1**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: HTTP adapter streamed responses bypass maxContentLength and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
You might also like:
See something that needs correcting? Let us knowUpdated May 05, 2026