Resource exhaustion in axios - CVE-2026-67318
Published: July 6, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU136916
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67318
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause uncontrolled resource consumption.
The vulnerability exists due to uncontrolled resource consumption in the Node.js HTTP/2 upload handling in the HTTP adapter when processing attacker-controlled streamed request bodies with httpVersion: 2 and a finite maxBodyLength. A remote user can supply a specially crafted oversized stream to cause uncontrolled resource consumption.
Only the Node.js HTTP adapter is affected. Browser adapters are not affected, and buffered request bodies are checked before the request is sent.
Affected software
axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
Data Cataloging
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
Data Cataloging
How to mitigate CVE-2026-67318
Install security update from vendor's website.
axios - update to 1.18.0
IBM Fusion HCI - update to 2.14.0
Data Cataloging - update to 2.5.6
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
IBM Fusion HCI - update to 2.14.0
Data Cataloging - update to 2.5.6
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2