axios CVE-2026-67318

Exploitation requires all five conditions to be simultaneously true: (1) the axios call uses the Node.js HTTP adapter, not a browser (XHR/fetch) adapter; (2) the request is configured with the explicit option httpVersion: 2; (3) the request body is supplied as a Node.js Readable stream - String, Buffer, and ArrayBuffer bodies are pre-checked before transport selection and are not exploitable; (4) a finite positive numeric value is set for maxBodyLength - applications using the default maxBodyLength: -1 (unlimited) do not cross any configured boundary and are explicitly unaffected; and (5) the attacker controls or meaningfully influences the content length or volume of the stream passed to axios, typically by being the source of an upload forwarded by a proxy. Exploitation is further bounded by impact: only resource consumption and policy bypass are achievable. For axios >=1.15.1, adding maxRedirects: 0 to the affected call removes the bypass even before upgrading.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) accurately captures the key characteristics: no confidentiality or integrity impact, limited availability impact only, and attack requirements present (AT:P) reflecting the specific configuration prerequisites required. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The CVE is not in CISA KEV and no public proof-of-concept exploit code was identified in the available intelligence. Real-world priority is low-to-medium: the vulnerability is actionable only for upload-proxy architectures that deliberately configure a finite maxBodyLength as a hard enforcement boundary over HTTP/2 with streamed bodies - deployments using the default maxBodyLength: -1 (unlimited) or non-streaming bodies are entirely outside the attack surface. A significant data quality issue must be flagged: the intelligence tags include 'RCE', which directly contradicts the advisory's explicit statement that the vulnerability does not enable code execution, credential disclosure, or request-destination control - that tag is erroneous and should be disregarded when triaging.

An attacker uploads an arbitrarily large file to a web application that proxies user uploads to an upstream storage or processing API over HTTP/2 using axios, with a finite maxBodyLength set to enforce a per-upload size cap. Because the HTTP/2 adapter bypasses the byte-counting wrapper, the full stream is forwarded to the upstream service regardless of size, consuming bandwidth, storage quota, or API rate limits far beyond the operator's intended policy. No public proof-of-concept exploit code has been identified; the GHSA advisory documents local verification transmitting 2 MB against a 1 KB maxBodyLength limit on the v1.x codebase.