Description
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | 1.7.0 – < 1.18.0 | 1.18.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.18.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
| Debian 12 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.5.hum1 | RHSA-2026:50826, RHSA-2026:49714 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r30 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r26 | — |
| Wolfi rolling | langfuse-3 +1 | 3.223.0-r0 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | lerna | 9.0.7-r11 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r8 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r11 | — |
| Wolfi rolling | prism | 5.16.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.7.0, < 1.18.0 | 1.18.0 | GHSA-jqh4-m9w3-8hp9 |
Advisories 4
- RHSA-2026:50826 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:49714 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2958 IBM License Metric Tool: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
References
- GitHub Security Advisory (GHSA-jqh4-m9w3-8hp9) vendor-advisory
- VulnCheck Advisory: axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream third-party-advisory