GHSA-jqh4-m9w3-8hp9: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Summary
Axios's fetch adapter (a module that handles HTTP requests using the fetch API) fails to enforce the `maxBodyLength` setting (a limit on how much data can be uploaded) when the request body is a ReadableStream (a data source where the total size is unknown beforehand). This means an attacker could upload much larger files than the configured limit, wasting bandwidth and exhausting service quotas.
Classification
Affected Packages
Related Issues
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
Original source: https://github.com/advisories/GHSA-jqh4-m9w3-8hp9
First tracked: July 20, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 70%