axios 1.7.0 through 1.17.x fails to apply the maxBodyLength limit when the request body is a WHATWG ReadableStream and the Content-Length header cannot be determined. An attacker can supply a stream of unknown length, bypassing the configured upload size restriction. The unchecked data flow can cause uncontrolled network egress or exhaust server resources, potentially leading to denial of service.

The vulnerability affects the axios HTTP client library for Node.js, specifically versions 1.7.0 up to, but not including, 1.18.0. Any application that uses these axios versions and sends request bodies via the fetch adapter over streams is impacted.

The CVSS score of 6.3 indicates a moderate severity, but the lack of an EPSS score leaves the exact exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker who can send arbitrary HTTP requests to the affected application could craft aableStream payload without a Content-Length header to bypass the maxBodyLength check, forcing the application to accept and process very large or infinite streams, leading to memory or bandwidth exhaustion. The attack requires network access to the target endpoint and use of axios for the request.