TI-2026-47614 Aliases CVE-2026-67318 GHSA-mwf2-3pr3-8698

axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

HIGH 67CWE-400Published 2026-08-01 · Updated 2026-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 fixed, 18 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00616 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial axios (axios): 1.18.0axios (npm): 1.18.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
axios	axios	1.13.0 to before 1.18.0	1.18.0	Patch available	CNA
—	axios (npm)	1.13.0 to before 1.18.0	1.18.0	Patch available	GHSA-mwf2-3pr3-8698

axios Vendoraxios Affected 1.13.0 to before 1.18.0 Fixed in 1.18.0 Patch available CNA
axios (npm) Vendor— Affected 1.13.0 to before 1.18.0 Fixed in 1.18.0 Patch available GHSA-mwf2-3pr3-8698

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:axios:axios::::::node.js::*	1.13.0 to before 1.18.0	Vulnerable	axios

cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions 1.13.0 to before 1.18.0 Vulnerable ·axios

Remediation

Fix · CNA axios (axios) Fixed in 1.18.0
Fix · GHSA-mwf2-3pr3-8698 axios (npm) Fixed in 1.18.0 Advisory →

Red Hat 2 advisories

RHSA-2026:50826 Released 2026-08-05 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.1-0.5.2.hum1@aarch64, grafana13.1-13.1.1-0.5.2.hum1@src, grafana13.1-13.1.1-0.5.2.hum1@x86_64
RHSA-2026:49714 Released 2026-08-03 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.1-0.5.hum1@aarch64, grafana13.1-13.1.1-0.5.hum1@src, grafana13.1-13.1.1-0.5.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-01
axios 1.18.0
10 records Highest priority Priority HIGH 3 HIGH, 5 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-47617 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassPriority HIGH 70
- TI-2026-47609 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONPriority HIGH 67
- TI-2026-47615 axios before 0.33.0 Prototype Pollution via nested option objectsPriority MEDIUM 61
Show all 10 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
Migration Toolkit for Containers	Affected	No fix yet: Fix deferred
Multicluster Engine for Kubernetes	Affected	No fix yet: Fix deferred
Network Observability Operator	Affected	No fix yet: Fix deferred
OpenShift Pipelines	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Security 4	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Trusted Profile Analyzer	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:49714, RHSA-2026:50826

Not affected: 1 product

Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-67318
2026-10-03 Alias added: GHSA-mwf2-3pr3-8698
2026-10-09 Affected versions changed · Red Hat

References

Exploit 1

GitHub Security Advisory (GHSA-mwf2-3pr3-8698)

Advisory 2

Other 4

TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences