Skip to content
Heist/ feed
Back to feed
Medium

Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Type: advisorySources: OSV

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-42034
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 05:45 UTC · Revision 1

Source evidence

Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

core-osv · Original source

Published 24 Apr 2026, 17:59 UTC

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.

osv:CVE-2026-42034
Complete source record
{
  "id": "026350228051817b1aee5e30ffccd3c8e5980ac037537c38f02e0170233de69e",
  "url": "https://osv.dev/vulnerability/CVE-2026-42034",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0",
    "summary": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.",
    "evidence": "osv:CVE-2026-42034",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-42034",
      "aliases": [
        "CVE-2026-42034",
        "GHSA-5c9x-8gcm-mpgx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/axios/axios",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a589dc525af12e0fabef7d6e5be028ad433eee31"
                },
                {
                  "introduced": "484aa4fe6addccbd32206a31eb3d2d000843066e"
                },
                {
                  "fixed": "ac42446be51300fe214ba3c6e40cc95f34fd6871"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.31.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "1.0.0"
                      },
                      {
                        "fixed": "1.15.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.31.0",
            "v1.15.0",
            "v1.14.0",
            "v1.13.6",
            "v0.30.3",
            "v0.30.2",
            "v1.13.5",
            "v1.13.4",
            "v1.13.3",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v0.30.1",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v0.30.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v0.29.0",
            "v1.7.9",
            "v1.7.8",
            "v1.7.7",
            "v1.7.6",
            "v1.7.5",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v0.28.1",
            "v1.7.1",
            "v1.7.0",
            "v1.7.0-beta.2",
            "v1.7.0-beta.1",
            "v1.7.0-beta.0",
            "v1.6.8",
            "v1.6.7",
            "v0.28.0",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.3.6",
            "v1.3.5",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.6",
            "v1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "1.2.2",
            "v1.2.1",
            "v1.2.0",
            "1.2.0-alpha.1",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.0",
            "v0.27.2",
            "v0.27.1",
            "v0.27.0",
            "v0.26.0",
            "v0.26.1",
            "v0.25.0",
            "v0.24.0",
            "v0.23.0",
            "0.21.3",
            "v0.21.2",
            "v0.21.0",
            "v0.20.0",
            "v0.20.0-0",
            "v0.19.2",
            "0.19.1",
            "v0.19.1",
            "v0.19.0",
            "v0.18.0",
            "v0.19.0-beta.1",
            "v0.17.1",
            "v0.17.0",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0",
            "v0.15.3",
            "v0.15.2",
            "v0.15.1",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.1",
            "v0.9.0",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.0",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42034.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.339700418Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42034.json",
        "https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-42034"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-770"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42034.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-42034",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492821,
  "published_at": "2026-04-24T17:59:47.802+00:00"
}