axios CVE-2026-67317

All four of the following conditions must hold simultaneously: (1) the application uses axios with adapter: 'fetch' explicitly set, or runs in an environment where axios auto-selects the fetch adapter (edge runtimes such as Cloudflare Workers, Vercel Edge, Deno Deploy, or browser-side usage); (2) the request uses a body-bearing method (POST, PUT, or PATCH); (3) the request body is a WHATWG ReadableStream object with no reliable finite Content-Length, meaning the stream length cannot be determined before dispatch; and (4) the application sets maxBodyLength to a finite value and treats it as the primary or sole upload-size guard. Known-length body types (strings, Blob, ArrayBuffer, ArrayBufferView, URLSearchParams, spec-compliant FormData, or requests with an explicit finite Content-Length header) are not affected even on the fetch adapter path. Exploitation yields no code execution, no confidentiality breach, and no integrity modification - impact is strictly availability through resource exhaustion.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) captures the key risk profile: network-reachable and low-complexity once prerequisites are met, but gated behind AT:P - the specific attack requirement that the application uses the fetch adapter, accepts a WHATWG ReadableStream body of unknown length from an attacker, and relies on maxBodyLength as its primary size control. The impact ceiling is limited availability (VA:L/SA:L) - no code execution, no credential exposure, no data exfiltration path exists. No EPSS score was provided in the input; exploitation probability cannot be quantitatively stated. The vulnerability is not listed in CISA KEV, and no public exploit exists at time of analysis. Real-world risk is concentrated in edge-runtime deployments (Cloudflare Workers, Vercel Edge, Deno Deploy) or browser-side axios usage where fetch is the default adapter, and specifically in applications that act as upload proxies relaying untrusted user-provided streams. For typical Node.js server-side axios usage with the HTTP adapter, this vulnerability does not apply, making it lower priority for the majority of the npm install base.

An attacker targeting an upload-proxy endpoint built on axios with the fetch adapter crafts a streaming POST body with no Content-Length header and begins sending data continuously. Because getBodyLength() returns undefined for the ReadableStream, the maxBodyLength check is silently skipped and axios passes the full unbounded stream to fetch(), forwarding all bytes to the upstream service. The attacker sustains the stream long enough to exhaust the application's outbound bandwidth allocation or consume the upstream API's rate-limited quota, degrading availability for legitimate users.