{"items":[{"id":"NVI-00014049","kind":"vulnerability","title":"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jqh4-m9w3-8hp9","CVE-2026-67317"],"plain_summary":"GitHub lists this reviewed advisory for axios. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-386aac4970690c81ce949c4fd3c1f6ef"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-386aac4970690c81ce949c4fd3c1f6ef","url":"https://github.com/advisories/GHSA-jqh4-m9w3-8hp9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jqh4-m9w3-8hp9","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:50.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-386aac4970690c81ce949c4fd3c1f6ef"],"technology":"axios","known_exclusions":[],"conditions_summary":"## Summary\n\naxios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected. The HTTP adapter’s stream upload path is not affected.\n\n## Impact\n\nAn attacker who can supply or influence a streamed request body can bypass the caller’s configured upload-size limit. Practical impact is unexpected outbound network egress, request-level resource consumption, and possible exhaustion of upstream API quotas or bandwidth.\n\nThis does not expose response data, execute code, or modify axios configuration. Exploitability depends on an application passing attacker-controlled, unknown-length stream data to axios and relying on `maxBodyLength` as the size guard.\n\n## Affected Functionality\n\nAffected:\n- `adapter: \"fetch\"` or environments where axios selects the fetch adapter.\n- Request","public_affected_ranges":[">= 1.7.0, < 1.18.0"]}],"null_published_at":"2026-11-02T10:00:37.201Z","source_updated_at":"2026-09-01T18:38:59.000Z","source_disclosed_at":"2026-07-20T22:27:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:50.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}