CVE-2026-67313: axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply Form
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-67313
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-67313 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for axios
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-67321: axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializin…nvd · 2026-08-01
- unknownCVE-2026-67320: axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-co…nvd · 2026-08-01
- unknownCVE-2026-67319: axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested reque…nvd · 2026-08-01
- unknownCVE-2026-67318: axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength li…nvd · 2026-08-01
- unknownCVE-2026-67317: axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream req…nvd · 2026-08-01
- unknownCVE-2026-67316: axios is vulnerable to read-side prototype-pollution gadgets that can alter request constructi…nvd · 2026-08-01
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01