CVE-2026-67313

unknowncovered by 1 sourcefirst seen 2026-08-01

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

⚡ Watch CVE-2026-67313

Get an email if CVE-2026-67313 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-67313: axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processi…nvd · 2026-08-01

External references

NVD record for CVE-2026-67313

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67313 status](https://www.csirts.com/badge/CVE-2026-67313)](https://www.csirts.com/cve/CVE-2026-67313)