CVE-2026-67313 Details
Description
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
A denial-of-service vulnerability has been identified in Axios versions 0.28.0 and later. The issue arises from uncontrolled recursion in the 'formDataToJSON' function, which is used to convert FormData into JSON. This vulnerability can be exploited by supplying FormData with field names that contain deeply nested brackets, causing the JavaScript call stack to become exhausted. As a result, a RangeError is triggered, leading to request failures or process termination in applications that do not properly handle such exceptions.
Users can upgrade to Axios version 1.18.0 or later, where this vulnerability has been patched. If an immediate upgrade is not possible, FormData field names can be validated to ensure they do not exceed a safe nesting depth before conversion to JSON or before sending the data in an Axios request.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 | [email protected] | ExploitMitigationVendor Advisory |
| https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | >= 0.28.0, < 1.18.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |