CVE-2026-67321 Details

A denial-of-service vulnerability has been identified in Axios versions prior to 0.33.0. The issue arises from an incomplete depth-limit bypass in the form data serialization process. When objects with top-level keys ending in '{}' are serialized, the depth guard fails to inspect nested structures properly. This flaw allows attackers to manipulate object keys and values, triggering a RangeError from JSON.stringify() and causing a denial-of-service condition in the affected request path.

Axios users can update to version 0.33.0 or 1.18.0 and later, where this vulnerability has been patched. For applications that cannot be updated, it is recommended to validate and limit the depth of untrusted objects before serialization, or to manually construct FormData or URLSearchParams after ensuring the input depth is acceptable.