https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 18:51:24 +0000 https://db.gcve.eu/vuln/ghsa-mwf2-3pr3-8698 <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.</p> <p>This affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.</p> <p>## Impact</p> <p>An attacker who can control a stream passed to axios can cause the application to transmit more outbound data than the configured `maxBodyLength` limit.</p> <p>Practical impact is limited to resource consumption and policy bypass: excess outbound bandwidth, egress cost, upstream quota consumption, and limited availability impact on the application or upstream peer. This does not provide code execution, credential disclosure, or request destination control.</p> <p>Browser adapters are not affected. Axios calls using the default unlimited `maxBodyLength: -1` do not cross this specific configured-limit boundary.</p> <p>## Affected Functionality</p> <p>Affected calls require all of the following:</p> <p>- Node.js HTTP adapter. - `httpVersion: 2`. - Request `data` supplied as a stream. - A finite `maxBodyLength`. - Attacker-controlled or attacker-influenced stream contents.</p> <p>Unaffected or differently affected paths:</p> <p>- String, Buffer, and ArrayBuffer request bodies are checked before transport selection. - Browser XHR/fetch adapters are not affected. - HTTP/1.1 requests using…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.</p> <p>This affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.</p> <p>## Impact</p> <p>An attacker who can control a stream passed to axios can cause the application to transmit more outbound data than the configured `maxBodyLength` limit.</p> <p>Practical impact is limited to resource consumption and policy bypass: excess outbound bandwidth, egress cost, upstream quota consumption, and limited availability impact on the application or upstream peer. This does not provide code execution, credential disclosure, or request destination control.</p> <p>Browser adapters are not affected. Axios calls using the default unlimited `maxBodyLength: -1` do not cross this specific configured-limit boundary.</p> <p>## Affected Functionality</p> <p>Affected calls require all of the following:</p> <p>- Node.js HTTP adapter. - `httpVersion: 2`. - Request `data` supplied as a stream. - A finite `maxBodyLength`. - Attacker-controlled or attacker-influenced stream contents.</p> <p>Unaffected or differently affected paths:</p> <p>- String, Buffer, and ArrayBuffer request bodies are checked before transport selection. - Browser XHR/fetch adapters are not affected. - HTTP/1.1 requests using…</p> https://db.gcve.eu/vuln/ghsa-mwf2-3pr3-8698