Packages / axios / Security

ModerateVulnerabilityGHSA-5c9x-8gcm-mpgxCVE-2026-42034Published 5 May 2026

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Affected releases · axios

  • 1.x1.0.0 – 1.15.0Fixed in 1.15.1
  • 0.31.x0.31.0Fixed in 0.31.1
  • 0.30.x0.30.0 – 0.30.4No fix on this line yet
  • 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated

On 1.x, the newest line:

npm install axios@1.15.1
1.x

  1. Affected

    1.0.0 – 1.15.0

    62 releases

  2. Fixed

    1.15.1 – 1.20.0

    9 releases, latest

0.x

  1. Affected

    0.1.0 – 0.31.0

    65 releases

  2. Fixed

    0.31.1 – 0.34.0

    4 releases

140 stable releases of axios, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

Summary

For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits.

Details

Relevant flow in lib/adapters/http.js:

  • 556-564: maxBodyLength check applies only to buffered/non-stream data.

  • 681-682: maxRedirects === 0 selects native http/https transport.

  • 694-699: options.maxBodyLength is set, but native transport does not enforce it.

  • 925-945: stream is piped directly to socket (data.pipe(req)) with no Axios byte counting.

This creates a path-specific bypass for streamed uploads.

PoC

Environment:

  • Axios main at commit f7a4ee2

  • Node v24.2.0

Steps:

  1. Start an HTTP server that counts uploaded bytes and returns {received}.

  2. Send a 2 MiB Readable stream with:

    • adapter: 'http'

    • maxBodyLength: 1024

    • maxRedirects: 0

Observed:

  • Request succeeds; server reports received: 2097152.

Control checks:

  • Same stream with default/nonzero redirects: rejected with ERR_FR_MAX_BODY_LENGTH_EXCEEDED.

  • Buffered body with maxRedirects: 0: rejected with ERR_BAD_REQUEST.

Impact

Type: DoS / uncontrolled upstream upload / resource exhaustion. Impacted: Node.js services using streamed request bodies with maxBodyLength expecting hard enforcement, especially when following Axios guidance to use maxRedirects: 0 for streams.