GHSA-mwf2-3pr3-8698: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
(updated )
Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.
This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.
References
- github.com/advisories/GHSA-mwf2-3pr3-8698
- github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
- github.com/axios/axios/pull/11000
- github.com/axios/axios/releases/tag/v1.18.0
- github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698
- nvd.nist.gov/vuln/detail/CVE-2026-67318
- nvd.nist.gov/vuln/detail/CVE-2026-68948
Code Behaviors & Features
Detect and mitigate GHSA-mwf2-3pr3-8698 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →