GHSA-39j5-w47m-2gmv

Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Published

2026-08-01

Modified

2026-09-01

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jqh4-m9w3-8hp9. This link is maintained to preserve external references. ## Original Description axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-39j5-w47m-2gmv