CVE-2026-67313

HighCVSS 7.5/10Last modified Sep 1, 2026

Description

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
axios	axios	>= 0.28.0, < 1.18.0

References

https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3Exploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojsonThird Party Advisory
https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3Exploit, Mitigation, Vendor Advisory

Timeline

Published: Aug 1, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-673146.5axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and CVE-2026-673157.5axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowi CVE-2026-673167.4axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been poll CVE-2026-673177.5axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-CVE-2026-673185.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests a CVE-2026-673193.7axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process'CVE-2026-67327.5A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated CVE-2026-673207.5axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request c CVE-2026-673217.5axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing obje CVE-2026-673227.5GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed th CVE-2026-673238.4GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allo CVE-2026-673249.8GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its