What is GHSA-39j5-w47m-2gmv?

GHSA-39j5-w47m-2gmv is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Why does GHSA-39j5-w47m-2gmv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-39j5-w47m-2gmv?

GHSA-39j5-w47m-2gmv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-39j5-w47m-2gmv?

GHSA-39j5-w47m-2gmv affects 1 product, including: npm/axios:\u003e= 1.7.0, \u003c 1.18.0.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 1, 2026

GHSA-39j5-w47m-2gmvMediumCVSS 7.5Disclosed before NVD

Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

September 1, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jqh4-m9w3-8hp9. This link is maintained to preserve external references.

Original Description

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

🎯 Affected products1

npm/axios:>= 1.7.0, < 1.18.0

🔗 References (4)

https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9
https://nvd.nist.gov/vuln/detail/CVE-2026-67317
https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream
https://github.com/advisories/GHSA-39j5-w47m-2gmv