CVE-2026-67321: axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and ne
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-67321
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-67321 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for axios
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-67320: axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-co…nvd · 2026-08-01
- unknownCVE-2026-67319: axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested reque…nvd · 2026-08-01
- unknownCVE-2026-67318: axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength li…nvd · 2026-08-01
- unknownCVE-2026-67317: axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream req…nvd · 2026-08-01
- unknownCVE-2026-67316: axios is vulnerable to read-side prototype-pollution gadgets that can alter request constructi…nvd · 2026-08-01
- unknownCVE-2026-67315: axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldB…nvd · 2026-08-01
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01