EUVD-2026-51863
GHSA-39j5-w47m-2gmv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack prerequisites (fetch adapter selected, attacker-controlled ReadableStream, no Content-Length) map to AC:H; no auth required; impact is availability-only with no C or I effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
AnalysisAI
The fetch adapter in axios 1.7.0 through 1.17.x silently skips the maxBodyLength enforcement when a WHATWG ReadableStream body has no determinable Content-Length, allowing attacker-supplied stream data to bypass configured upload size limits. Applications that proxy or relay untrusted stream data via axios with the fetch adapter and rely solely on maxBodyLength as the size guard are exposed to uncontrolled outbound egress and potential exhaustion of upstream API quotas or bandwidth. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four of the following conditions must hold simultaneously: (1) the application uses axios with adapter: 'fetch' explicitly set, or runs in an environment where axios auto-selects the fetch adapter (edge runtimes such as Cloudflare Workers, Vercel Edge, Deno Deploy, or browser-side usage); (2) the request uses a body-bearing method (POST, PUT, or PATCH); (3) the request body is a WHATWG ReadableStream object with no reliable finite Content-Length, meaning the stream length cannot be determined before dispatch; and (4) the application sets maxBodyLength to a finite value and treats it as the primary or sole upload-size guard. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L) captures the key risk profile: network-reachable and low-complexity once prerequisites are met, but gated behind AT:P - the specific attack requirement that the application uses the fetch adapter, accepts a WHATWG ReadableStream body of unknown length from an attacker, and relies on maxBodyLength as its primary size control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an upload-proxy endpoint built on axios with the fetch adapter crafts a streaming POST body with no Content-Length header and begins sending data continuously. Because getBodyLength() returns undefined for the ReadableStream, the maxBodyLength check is silently skipped and axios passes the full unbounded stream to fetch(), forwarding all bytes to the upstream service. … |
| Remediation | Upgrade to axios 1.18.0, which resolves the issue by adding a ReadableStream branch to getBodyLength() so that maxBodyLength is enforced for stream bodies; the fix is in commit 32fc489632377d214db55bfa4e2c48486a7d7ce2 (merged via PR #11000). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today