CVE-2026-67318

Executive Summary

CVE-2026-67318 is a logic flaw in the axios Node.js HTTP adapter affecting versions >=1.13.0. When an application sends a streamed request body over HTTP/2 with httpVersion: 2, axios does not enforce the finite maxBodyLength configuration. This occurs because Node's HTTP/2 request API does not natively respect axios's maxBodyLength option, and axios's own byte-counting stream wrapper is effectively gated behind the maxRedirects === 0 condition.

The impact is limited to resource consumption and policy bypass: an attacker who controls a stream can cause the application to transmit outbound data beyond the configured limit, leading to excess egress, upstream quota consumption, and potential local availability degradation. There is no code execution, credential disclosure, or request-destination control. Default maxBodyLength: -1 configurations and browser adapters are not affected.

Supply Chain & Package Security

axios is one of the most widely deployed npm packages in the Node.js ecosystem. This vulnerability is particularly important from a software supply chain perspective because:

• axios is a transitive dependency of thousands of services and CLI tools.
• The vulnerable behavior is triggered by application configuration, meaning upstream dependencies may silently inherit the flaw.
• At the time of writing, no official patch, OSV advisory, or GitHub Security Advisory is available; the upstream status remains UNKNOWN / UNPATCHED.
• Organizations must audit direct and transitive axios usage, explicitly checking for httpVersion: 2 and streamed request bodies.

CVSS Breakdown & Threat Level

The NVD record lists a CVSS score of 0.0, which is likely due to incomplete analysis rather than a true lack of impact. Based on the technical description, a more realistic threat model is:

Overall, this vulnerability should be treated as a medium-risk policy enforcement bypass rather than a critical remote compromise. It is best exploited alongside another application flaw that allows an attacker to influence request body streams, such as an SSRF, upload validation bypass, or prototype pollution in request construction.

Deep Dive & Mechanics

In axios versions >=1.13.0, the Node.js HTTP adapter uses the http and https modules for standard HTTP/1.1 traffic and the http2 module when httpVersion: 2 is requested.

The maxBodyLength option is intended to cap the size of a request body. For ordinary Buffer or string bodies, the limit is enforced at the adapter level. For streamed bodies, axios needs to wrap the stream in a counting mechanism that tracks how many bytes have been written. However, the implementation places the stream wrapper behind a condition related to maxRedirects === 0.

The concrete failure is:

1. Application sets maxBodyLength: 1024.
2. Application passes a Readable stream as the request body.
3. Application additionally sets httpVersion: 2.
4. Node's http2.ClientHttp2Stream accepts the stream and begins sending DATA frames.
5. axios's byte-counting wrapper is not attached because the gating condition expects maxRedirects === 0, which may not be true, or because the HTTP/2 path bypasses the legacy wrapper entirely.
6. The remote server receives a body larger than maxBodyLength, violating the configured policy.

Because Node's HTTP/2 implementation does not have a built-in maxBodyLength equivalent, the entire responsibility falls on axios. The legacy counting wrapper was designed for the HTTP/1.x redirect chain and does not map cleanly to the HTTP/2 adapter.

The vulnerability does not allow code execution. It is purely a policy-bypass and resource-exhaustion issue. An attacker who can control the content of the stream can force an organization to consume excessive network egress and upstream quotas, potentially increasing cloud bills or causing denial-of-service against upstream APIs.

Vulnerable vs. Patched Code

The vulnerable behavior can be represented as follows. This is a simplified idiomatic example of the axios adapter logic.

Vulnerable Node.js pattern

const axios = require('axios');
const { PassThrough } = require('stream');

// Config intentionally sets a small limit
const config = {
  maxBodyLength: 1024,
  maxRedirects: 0,
  httpVersion: 2,
};

async function uploadAttackerControlledStream() {
  const stream = new PassThrough();

  // Attacker can write arbitrarily many bytes
  for (let i = 0; i < 10000; i++) {
    stream.write(Buffer.alloc(1024, 0x41));
  }
  stream.end();

  await axios.post('https://target.example/upload', stream, config);
}

In a patched adapter, the stream would be wrapped before being handed to the HTTP/2 transport:

const axios = require('axios');
const { Transform } = require('stream');

function enforceMaxBodyLength(bodyStream, maxLength) {
  let transferred = 0;

  return new Transform({
    transform(chunk, enc, callback) {
      transferred += chunk.length;
      if (transferred > maxLength) {
        const err = new Error(`maxBodyLength limit of ${maxLength} exceeded`);
        err.code = 'ERR_BODY_LENGTH_TOO_LARGE';
        return callback(err);
      }
      callback(null, chunk);
    },
  });
}

async function patchedUpload(stream) {
  const limitedStream = enforceMaxBodyLength(stream, 1024);

  await axios.post('https://target.example/upload', limitedStream, {
    maxBodyLength: 1024,
    maxRedirects: 0,
    httpVersion: 2,
  });
}

Until an official patch is available, any custom wrapper that explicitly measures bytes on the outgoing stream is the safest mitigation.

Exploitation & Lab Setup

No public exploit code or Nuclei template was available at the time of analysis. The following lab setup demonstrates the vulnerability in a controlled environment and provides guidance for both red team validation and blue team detection.

Red Team Validation Lab

The goal is to prove that an attacker-controlled stream can exceed a configured maxBodyLength when HTTP/2 is used.

Create a minimal test server that accepts HTTP/2 uploads:

// server.js
const http2 = require('http2');

const server = http2.createServer();
server.on('stream', (stream) => {
  let received = 0;

  stream.on('data', (chunk) => {
    received += chunk.length;
  });

  stream.on('end', () => {
    stream.respond({ ':status': 200 });
    stream.end(`received: ${received}`);
  });
});

server.listen(8443, () => {
  console.log('HTTP/2 server listening on 8443');
});

Create the axios client:

// client.js
const axios = require('axios');
const { PassThrough } = require('stream');

async function run() {
  const body = new PassThrough();

  // Simulate attacker-controlled data
  setInterval(() => body.write(Buffer.alloc(1024, 0x42)), 1);

  try {
    const response = await axios.post(
      'https://localhost:8443/upload',
      body,
      {
        httpsAgent: new (require('https').Agent)({
          rejectUnauthorized: false,
        }),
        maxBodyLength: 2048,
        maxRedirects: 0,
        httpVersion: 2,
      }
    );

    console.log('Server response:', response.data);
  } catch (err) {
    console.error('Axios error:', err.message);
  }
}

run();

Run the lab:

node server.js &
sleep 1
node client.js

Expected result: the server reports a received size much larger than 2048, proving that maxBodyLength did not stop the stream.

Blue Team Validation Lab

Blue teams should use the same lab to generate baselines and tune detection:

1. Deploy the server in a DMZ or isolated network segment.
2. Run the client with expected traffic volumes.
3. Capture network traffic with tcpdump or Wireshark.
4. Validate that the HTTP/2 DATA frame lengths and total POST body length exceed the configured policy.
5. Use the captured traffic to tune the YARA, Sigma, and Suricata rules provided in this report.

Indicators of Compromise (IOCs)

Because CVE-2026-67318 does not install malware or modify systems, the indicators are behavioral and network-oriented:

• Excessive outbound HTTP/2 DATA frames from a Node.js process to a single upstream destination.
• POST request bodies over HTTP/2 that exceed the application's configured maxBodyLength.
• Error logs containing messages such as ERR_BODY_LENGTH_TOO_LARGE when the custom wrapper is used, though the vulnerable path may not log any error.
• Process command lines containing axios, httpVersion, and a streamed upload source, e.g., /dev/zero, PassThrough, or a named pipe.
• Sharp spikes in egress traffic correlated with Node.js processes and HTTP/2 destinations.

Network IO

HTTP/2 connection to external hosts with DATA frame sequences where cumulative payload > configured maxBodyLength

Host IO

node process with network sockets toward remote:443
node command line includes "maxBodyLength"
node command line includes "httpVersion"

Detection Engineering

The following detection content can be used to identify code patterns, process activity, and network traffic associated with CVE-2026-67318.

YARA Rule

YARA can be used to scan source code repositories for axios configurations that combine HTTP/2 and streamed requests without proper byte-counting wrappers.

rule Axios_MaxBodyLength_HTTP2_Bypass {
    meta:
        author = "Valters IT"
        description = "Detects axios code patterns susceptible to CVE-2026-67318 maxBodyLength HTTP/2 bypass"
        reference = "CVE-2026-67318"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $a = "maxBodyLength" ascii
        $b = "httpVersion: 2" ascii
        $c = "httpVersion:2" ascii
        $d = "isStream" ascii
        $e = "PassThrough" ascii
        $f = "createWriteStream" ascii
    condition:
        $a and ($b or $c) and ($d or $e or $f)
}

Sigma Rule

Sigma can be used in SIEMs to detect Node.js processes that are likely sending HTTP/2 requests through axios.

title: Axios HTTP/2 Streamed Request Body Exceeds maxBodyLength
id: 10c8e6c0-2f5e-4c20-9b0e-6b5b4f3b8c3a
status: experimental
description: Detects Node.js processes using axios with HTTP/2 and maxBodyLength configuration, which may be vulnerable to CVE-2026-67318
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-67318
author: Valters IT
date: 2026/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/node'
        CommandLine|contains:
            - 'maxBodyLength'
            - 'httpVersion'
            - 'stream'
            - 'axios'
    condition: selection
falsepositives:
    - Legitimate Node.js applications that intentionally stream payloads with HTTP/2
    - Security tools that exercise HTTP/2 egress paths
level: low

Suricata Rule

Suricata can identify outbound HTTP/2 requests where the request body is unusually large and likely exceeds the intended limit.

alert http any any -> any any (msg:"CVE-2026-67318 Axios HTTP/2 maxBodyLength bypass egress"; flow:to_server; http.protocol:http2; http.request_body_len:>1048576; sid:2026067318; rev:1;)

This rule is intentionally broad. It should be paired with application-level maxBodyLength configuration values and egress quota policies to reduce false positives.

Remediation & Mitigation

As of this report, there is no official patch for CVE-2026-67318. The upstream axios maintainers have not released a fixed version, and the GitHub Advisory is marked as UNKNOWN / UNPATCHED.

Immediate mitigations:

1. Avoid HTTP/2 in axios clients for now. Force HTTP/1.1 by setting httpVersion: "1.1" when possible. This restores the legacy byte-counting behavior.
2. Manually wrap streamed bodies with a Transform stream that enforces the byte limit and destroys the stream with ERR_BODY_LENGTH_TOO_LARGE.
3. Set maxBodyLength to a hard finite value in all axios configurations. Default of -1 bypasses the limit entirely but is not the vulnerable condition; nevertheless, finite limits are recommended.
4. Audit all direct and transitive axios dependencies with npm audit, yarn audit, or pnpm audit. Because the issue is unpatched, dependency ranges cannot be fixed through normal package manager advisories yet.
5. Monitor egress traffic for sudden spikes from Node.js processes using HTTP/2.
6. Watch upstream axios releases for a patch version that enforces maxBodyLength in the HTTP/2 adapter path.

Long-term supply chain actions:

• Add axios package source scanning to CI/CD using the YARA rule above.
• Implement runtime egress policy at the network layer, particularly for HTTP/2 streams.
• Consider replacing axios HTTP/2 usage with Node's native fetch or http2 library, and enforce body size limits in application middleware.

Valters IT