Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-jqh4-m9w3-8hp9 (which GHSA-39j5-w47m-2gmv duplicates), describes a maxBodyLength bypass in the Axios fetch adapter when handling WHATWG ReadableStream request bodies. The core issue stems from the adapter's inability to determine the content length of such streams, leading to the maxBodyLength checks being bypassed.
Based on the detailed technical description in the advisory, three key areas in lib/adapters/fetch.js contribute to this vulnerability:
getBodyLength: This function is responsible for calculating the length of various request body types. In the vulnerable versions, it lacks specific handling for ReadableStream objects. As a result, when a ReadableStream is provided as the request body, getBodyLength fails to return a finite length, leading to resolveBodyLength returning undefined.
maxBodyLengthEnforcement (inline logic): The advisory explicitly states that the pre-dispatch maxBodyLength check (located around lines 214-232 in fetch.js in the vulnerable version) 'short-circuits' when the body length is undefined (as is the case for ReadableStream due to the getBodyLength issue). This means the primary security control for body length is effectively disabled for ReadableStream uploads.
trackStream: Even when onUploadProgress is enabled, the trackStream wrapper, which monitors the stream's progress, does not receive or enforce the maxBodyLength limit. Its sole purpose is progress reporting, not security enforcement. Therefore, even if the initial maxBodyLength check is bypassed, trackStream allows the entire, potentially oversized, ReadableStream to be transmitted without interruption.
Exploitation would involve an attacker supplying an arbitrarily large ReadableStream as the request body, bypassing the intended maxBodyLength limit, and potentially causing resource exhaustion or unexpected network egress on the server or proxy receiving the request. These functions would appear in a runtime profiler during the processing of such a malicious request, indicating the points of failure in enforcing size limits.
getBodyLengthlib/adapters/fetch.js
maxBodyLengthEnforcementlib/adapters/fetch.js
trackStreamlib/adapters/fetch.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 1.7.0, < 1.18.0 |