Resource exhaustion in Axios
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength opt…
Vulnerability class: DoS (Denial of Service)
Affected products
- Axios — versions 1.13.0, 1.18.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)