GHSA-mwf2-3pr3-8698: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
(updated )
Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.
This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.
References
- github.com/advisories/GHSA-mwf2-3pr3-8698
- github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
- github.com/axios/axios/pull/11000
- github.com/axios/axios/releases/tag/v1.18.0
- github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698
- nvd.nist.gov/vuln/detail/CVE-2026-67318
- nvd.nist.gov/vuln/detail/CVE-2026-68948
Code Behaviors & Features
Detect and mitigate GHSA-mwf2-3pr3-8698 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →