GHSA-mwf2-3pr3-8698: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent. Impact An attacker who can control a stream passed to axios can cause the application to transmit more outbound data than the configured maxBodyLength limit. Practical impact is limited to resource consumption and policy bypass: excess outbound bandwidth, egress cost, upstream quota consumption, and limited availability impact on the application or upstream peer. This does not provide code execution, credential disclosure, or request destination control. Browser adapters are not affected. Axios calls using the default unlimited maxBodyLength: -1 do not cross this specific configured-limit boundary. Affected Functionality Affected calls require all of the following: - Node.js HTTP adapter. - httpVersion: 2. - Request data supplied as a stream. - A finite maxBodyLength. - Attacker-controlled or attacker-influenced stream contents. Unaffected or differently affected paths: - String, Buffer, and ArrayBuffer request bodies are checked before transport selection. - Browser XHR/fetch adapters are not affected. - HTTP/1.1 requests using follow-redirects enforce options.maxBodyLength. - In axios >=1.15.1, setting maxRedirects: 0 on affected HTTP/2 upload calls activates axios’ existing stream wrapper and rejects oversized streams. Technical Details In lib/adapters/http.js, axios selects http2Transport whenever httpVersion resolves to 2. The adapter still stores config.maxBodyLength on options.maxBodyLength, but Node’s HTTP/2 request API does not enforce that option. The stream-level byte-counting wrapper is currently gated on config.maxBodyLength > -