Axios fetch adapter size limit bypass leading to resource exhaustion

CVE-2026-44488 affects Axios, a promise-based HTTP client for browsers and Node.js. In Axios versions 1.7.0 through 1.15.x, the fetch adapter did not enforce configured maxContentLength and maxBodyLength limits. As a result, applications using adapter: 'fetch', or running in environments where Axios selected the fetch adapter automatically, could send or receive bodies larger than the explicitly configured limits. This breaks an expected security boundary around request and response sizing. In server-side usage, exploitation can occur when a malicious or compromised upstream server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through Axios while relying on maxBodyLength for enforcement. The issue is effectively an uncontrolled resource consumption condition caused by failure to apply configured size restrictions in the fetch adapter path.