PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-67317 axios CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:01.817Z and has not been modified since then. CVE-2026-67317 involves axios versions 1.7.0 before 1.18.0 failing to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. This allows attackers to supply unknown-length stream data, potentially bypassing upload size limits and causing uncontrolled network egress or resource exhaustion. Teams using affected axios versions should verify configurations and implement defensive measures. Limited source detail; defensive verification tasks recommended.

Vendor
axios
Product
Unknown
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-01
Original CVE updated
2026-09-01
Advisory published
2026-08-01
Advisory updated
2026-09-01

Who should care

Teams using axios versions 1.7.0 before 1.18.0 should verify their configurations and implement defensive measures to prevent potential resource exhaustion and uncontrolled network egress. Affected operators, platforms, and security teams should review vulnerability management and compensating controls. Monitoring and asset inventory reviews are recommended to identify potential exposure. Security teams should track exceptions and retest remediated assets.

Technical summary

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. This allows attackers to supply unknown-length stream data, potentially bypassing upload size limits and causing uncontrolled network egress or resource exhaustion. Affected product deployments should be verified for exposure. The vulnerability class involves request body handling in axios, with potential operational impact on network egress and resource utilization. Evidence is limited; verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter.

Defensive priority

Medium-priority defensive actions recommended due to potential for resource exhaustion and uncontrolled network egress.

Recommended defensive actions

  • Verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter
  • Conduct inventory checks for affected versions
  • Monitor for unusual network activity
  • Implement compensating controls to limit network egress
  • Exception tracking for potential resource exhaustion

Evidence notes

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Evidence is limited; verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter. Conduct inventory checks for affected versions and monitor for unusual network activity. Limited source detail; defensive verification tasks recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-67317 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-67317

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-67317 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-67317

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.