CVE-2026-67317 axios CVE debrief

Who should care

Teams using axios versions 1.7.0 before 1.18.0 should verify their configurations and implement defensive measures to prevent potential resource exhaustion and uncontrolled network egress. Affected operators, platforms, and security teams should review vulnerability management and compensating controls. Monitoring and asset inventory reviews are recommended to identify potential exposure. Security teams should track exceptions and retest remediated assets.

Technical summary

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. This allows attackers to supply unknown-length stream data, potentially bypassing upload size limits and causing uncontrolled network egress or resource exhaustion. Affected product deployments should be verified for exposure. The vulnerability class involves request body handling in axios, with potential operational impact on network egress and resource utilization. Evidence is limited; verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter.

Defensive priority

Medium-priority defensive actions recommended due to potential for resource exhaustion and uncontrolled network egress.

Recommended defensive actions

• Verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter
• Conduct inventory checks for affected versions
• Monitor for unusual network activity
• Implement compensating controls to limit network egress
• Exception tracking for potential resource exhaustion

Evidence notes

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Evidence is limited; verify axios versions 1.7.0 before 1.18.0 for maxBodyLength enforcement in fetch adapter. Conduct inventory checks for affected versions and monitor for unusual network activity. Limited source detail; defensive verification tasks recommended.

Official resources