Summary by cubic

Fixes a limits bypass in the Node HTTP adapter by enforcing maxContentLength for streamed responses and maxBodyLength for streamed uploads when maxRedirects: 0. Prevents oversized payloads from being fully read or sent, addressing GHSA-vf2m-468p-8v99 and GHSA-5c9x-8gcm-mpgx.

Description

• Enforce maxContentLength for responseType: 'stream' by wrapping the response stream; throw AxiosError when the limit is exceeded.
• Enforce maxBodyLength for streamed uploads on native http/https when maxRedirects === 0 using a counting transform; fail early and destroy the request.
• Keep existing follow-redirects behavior otherwise; both paths now consistently enforce limits.

Docs

• maxContentLength now applies to streamed responses.
• maxBodyLength is enforced for streamed uploads when maxRedirects: 0 (native transport); other cases remain enforced by follow-redirects.
• Clients receive an error once limits are exceeded; streams stop early.

Testing

• Added four unit tests covering over/under limit for streamed responses and for streamed uploads with maxRedirects: 0.
• No additional tests needed.

^{Written for commit 34ea6dd. Summary will update on new commits.}