CVE-2026-42034

Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.

Affected

axios

CVSS v3.1 GITHUB

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Published

2026-04-24

Proof-of-concept exploits (1)

• advisories/GHSA-5c9x-8gcm-mpgx

Security advisories

• axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx

References

• CVE Record
• NVD entry