CVE-2026-44488: Axios Fetch Adapter Size Limit Bypass (CVSS 7.5)

Technical summary

The vulnerability stems from the fetch adapter in Axios not respecting configured request and response size boundaries. When the fetch API is used as the underlying transport (either explicitly via adapter: 'fetch' or automatically in environments that default to fetch), the maxContentLength and maxBodyLength configuration parameters are not enforced on the body stream. This allows responses or requests to bypass the intended size constraints. An attacker exploiting a server-side application could return a response larger than maxContentLength, causing memory pressure or denial of service. Similarly, if an application uses Axios to forward attacker-supplied payloads while relying on maxBodyLength as a security boundary, that boundary is effectively disabled. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

Organizations relying on Axios with the fetch adapter for backend services face a denial-of-service risk. A compromised or malicious server endpoint can force the Axios client to consume unbounded memory, potentially crashing the application or degrading availability. For applications that forward user-supplied data through Axios while using size limits as a validation safeguard, the limits become ineffective, opening a pathway for resource-exhaustion attacks or unintended processing of large payloads. The impact is most acute in resource-constrained environments such as serverless functions, containers, or embedded services where memory is finite.

Affected systems

Axios versions 1.7.0 through 1.15.x are affected when the fetch adapter is active. This includes: (1) applications that explicitly configure adapter: 'fetch'; (2) Node.js or browser environments that default to the fetch adapter; (3) modern Deno and edge runtime environments that may prefer fetch over alternative transports. Versions 0.32.0 and later, and 1.16.0 and later, contain the fix. Users on 1.6.x or earlier are not affected by this issue but should verify their Axios version independently.

Exploitability

Exploitability is straightforward and does not require authentication or user interaction. An attacker can exploit this in two primary scenarios: (1) as a client, by requesting a malicious endpoint that returns an oversized payload, forcing resource exhaustion on the client side; (2) as a server, by receiving a large forwarded request body that exceeds the configured limit but is processed anyway. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog, indicating no active in-the-wild exploitation has been publicly disclosed as of the last KEV update, but organizations should not rely on this as assurance.

Remediation

Upgrade Axios to version 1.16.0 (for 1.x users) or 0.32.0 (for 0.x users). If immediate patching is not feasible, consider switching to the default adapter (XMLHttpRequest in browsers or http/https in Node.js) if the fetch adapter was explicitly selected. Review application configurations to ensure maxContentLength and maxBodyLength are set to values appropriate for your use case, and monitor outbound requests for unexpected size anomalies. For critical backend services, implement independent size validation at the HTTP layer or in reverse proxy configurations (e.g., nginx) as a defense-in-depth measure.

Patch guidance

Verify the applicable patch version for your environment by consulting the Axios GitHub repository or security advisory. For npm-based projects, update via npm update axios or npm install axios@latest. Changelog entries and release notes will confirm the exact version containing the fix. Test the patched version in a staging environment, particularly if your application relies on the fetch adapter explicitly, to confirm that size limit behavior is now enforced as expected. Dependencies on Axios should be audited across your codebase to identify all affected libraries and tools.

Detection guidance

Monitor application logs and resource metrics for sudden spikes in memory consumption or connection timeouts coinciding with specific outbound requests. Implement request/response logging that captures body sizes and compare against configured limits; deviation may indicate an exploit attempt. Use static analysis tools or dependency checkers (e.g., npm audit, Snyk) to identify Axios versions in use. Network monitoring can detect attempts to return unusually large payloads to the application. If your application forwards user input through Axios, add application-level request validation to enforce size limits independently of Axios configuration.

Why prioritize this

This vulnerability warrants high priority due to its network accessibility (no authentication required), simplicity of exploitation, and potential for denial-of-service in production services. The impact is especially severe for backend applications, serverless deployments, and microservices where resource constraints are tight. However, the lack of active public exploitation and the straightforward patching path mean that organizations with mature update cadences can address it within a standard security update cycle rather than an emergency response.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no privileges required, and high availability impact. The vulnerability does not affect confidentiality or integrity directly, which prevents a critical rating. The score appropriately captures the denial-of-service risk but does not account for organizational context; a critical backend service with unpatched Axios should be treated with greater urgency than a non-critical application.

Frequently asked questions