{"id":"CVE-2026-42034","aliases":["GHSA-5c9x-8gcm-mpgx"],"url":"https://o3.security/vulnerability/CVE-2026-42034","summary":"Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0","details":"### Summary\n\nFor stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits.\n\n### Details\n\nRelevant flow in lib/adapters/http.js:\n  - 556-564: maxBodyLength check applies only to buffered/non-stream data.\n  - 681-682: maxRedirects === 0 selects native http/https transport.\n  - 694-699: options.maxBodyLength is set, but native transport does not enforce it.\n  - 925-945: stream is piped directly to socket (data.pipe(req)) with no Axios byte counting.\n\nThis creates a path-specific bypass for streamed uploads.\n\n  ### PoC\n\nEnvironment:\n\n  - Axios main at commit f7a4ee2\n  - Node v24.2.0\n\n  Steps:\n  1. Start an HTTP server that counts uploaded bytes and returns {received}.\n  2. Send a 2 MiB Readable stream with:\n      - adapter: 'http'\n      - maxBodyLength: 1024\n      - maxRedirects: 0\n\n  Observed:\n  - Request succeeds; server reports received: 2097152.\n\n  Control checks:\n  - Same stream with default/nonzero redirects: rejected with ERR_FR_MAX_BODY_LENGTH_EXCEEDED.\n  - Buffered body with maxRedirects: 0: rejected with ERR_BAD_REQUEST.\n\n  ### Impact\nType: DoS / uncontrolled upstream upload / resource exhaustion.\nImpacted: Node.js services using streamed request bodies with maxBodyLength expecting hard enforcement, especially when following Axios guidance to use maxRedirects: 0 for streams.","published":"2026-04-24T17:59:47.802Z","modified":"2026-08-12T03:51:24.447865691Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.00327,"percentile":0.25041,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"axios","fixedVersion":"1.15.1"},{"ecosystem":"npm","name":"axios","fixedVersion":"0.31.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42034.json"},{"type":"ADVISORY","url":"https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42034"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.447865691Z"}}