Sign in
Deutsch English Español Polski
Medium

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

  • Disclosed: 05.05.2026
  • Updated: 11.10.2026 10:22

Summary

For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits.

Details

Relevant flow in lib/adapters/http.js:

  • 556-564: maxBodyLength check applies only to buffered/non-stream data.
  • 681-682: maxRedirects === 0 selects native http/https transport.
  • 694-699: options.maxBodyLength is set, but native transport does not enforce it.
  • 925-945: stream is piped directly to socket (data.pipe(req)) with no Axios byte counting.

This creates a path-specific bypass for streamed uploads.

PoC

Environment:

  • Axios main at commit f7a4ee2
  • Node v24.2.0

Steps:

  1. Start an HTTP server that counts uploaded bytes and returns {received}.
  2. Send a 2 MiB Readable stream with:
    • adapter: 'http'
    • maxBodyLength: 1024
    • maxRedirects: 0

Observed:

  • Request succeeds; server reports received: 2097152.

Control checks:

  • Same stream with default/nonzero redirects: rejected with ERR_FR_MAX_BODY_LENGTH_EXCEEDED.
  • Buffered body with maxRedirects: 0: rejected with ERR_BAD_REQUEST.

Impact

Type: DoS / uncontrolled upstream upload / resource exhaustion. Impacted: Node.js services using streamed request bodies with maxBodyLength expecting hard enforcement, especially when following Axios guidance to use maxRedirects: 0 for streams.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package axios >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE)
CWE-770
Platform
npm
Package
axios
Disclosed
05.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5c9x-8gcm-mpgx - CC BY 4.0

Vulnerability history: axios

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (55) in the archive
Total entries
55
First → latest
05.2019 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 25
  • Medium 28
  • Low 2

Disclosures per year

Severity:
  1. Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
    High CVE-2026-101905 >= 1.15.2, < 1.20.0 1.20.0
  2. Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
    High CVE-2026-101907 >= 1.17.0, < 1.20.0 1.20.0
  3. Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
    High CVE-2026-101903 >= 1.16.1, < 1.20.0 1.20.0
  4. Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
    High CVE-2026-101906 >= 1.15.0, < 1.20.0 1.20.0
  5. Axios: Prototype Pollution Gadget in axios toFormData Options
    High CVE-2026-101909 >= 0.28.0, < 0.34.0, >= 1.15.1, < 1.20.0 0.34.0, 1.20.0
  6. Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
    High CVE-2026-101898 >= 1.13.0, < 1.20.0 1.20.0
  7. Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
    High CVE-2026-101901 >= 1.13.0, < 1.20.0 1.20.0
  8. Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
    High CVE-2026-67320 >= 0.31.1, < 0.33.0, >= 1.15.2, < 1.18.0 0.33.0, 1.18.0
  9. Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
    High · 7.5 CVE-2026-44496 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  10. Allocation of Resources Without Limits or Throttling in Axios
    High · 7.5 CVE-2026-44488 >= 1.7.0, < 1.16.0 1.16.0
  11. Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
    High CVE-2026-44487 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  12. Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
    High · 7.5 CVE-2026-44486 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  13. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
    High · 7.0 CVE-2026-44495 >= 1.0.0, < 1.15.2, >= 0.19.0, < 0.31.1 1.15.2, 0.31.1
  14. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
    High · 8.7 CVE-2026-44494 >= 1.0.0, < 1.16.0 1.16.0
  15. axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
    High · 8.6 CVE-2026-44492 >= 1.15.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  16. Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 this entry
    Medium · 5.3 CVE-2026-42034 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  17. Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
    High · 7.4 CVE-2026-42033 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  18. Axios: Header Injection via Prototype Pollution
    High · 7.4 CVE-2026-42035 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  19. Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
    High · 7.2 CVE-2026-42043 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  20. Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
    High · 7.4 CVE-2026-42264 >= 1.0.0, < 1.15.2 1.15.2
  21. Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
    High · 7.5 CVE-2026-25639 >= 1.0.0, < 1.13.5, < 0.30.3 1.13.5, 0.30.3
  22. Axios is vulnerable to DoS attack through lack of data size check
    High · 7.5 CVE-2025-58754 >= 1.0.0, < 1.12.0, >= 0.28.0, < 0.30.2 1.12.0, 0.30.2
  23. axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
    High CVE-2025-27152 >= 1.0.0, < 1.8.2, < 0.30.0 1.8.2, 0.30.0
  24. Server-Side Request Forgery in axios
    High CVE-2024-39338 >= 1.3.2, < 1.7.4 1.7.4
  25. axios Inefficient Regular Expression Complexity vulnerability
    High · 7.5 CVE-2021-3749 < 0.21.2 0.21.2
  26. Denial of Service in axios
    High · 7.5 CVE-2019-10742 < 0.18.1 0.18.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.