Axios versions from 1.13.0 through 1.17.x on the Node.js HTTP adapter do not apply the configured maxBodyLength limit when outbound requests are sent with HTTP/2. The library’s byte-counting stream wrapper is disabled for requests with maxRedirects set to zero, allowing a stream supplied by an attacker to exceed the intended body size. The resulting over‑send can consume excessive bandwidth or memory, causing resource exhaustion or violating egress quotas. The flaw does not provide code execution, credential disclosure, or arbitrary request destination control.

The affected product is Axios, an HTTP client for Node.js. Versions 1.13.0 up to and including 1.17.x are impacted when the Node.js HTTP adapter is used with httpVersion set to 2 and maxRedirects equal to zero. The library’s default maxBodyLength of -1 and its browser adapters are not affected. Environments using Axios for outbound HTTP/2 traffic may be vulnerable.

The CVSS score of 6.3 indicates medium severity. The EPSS score of 0.00356 indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting current exploitation likelihood is low to moderate. An attacker must control the stream payload and configure an outbound request that uses axios with httpVersion 2 and maxRedirects 0. Once achieved, the attacker can trigger excessive output that may drown network resources or exceed configured egress limits, but cannot directly execute code or extract sensitive data from the application.