CVE-2026-67313 PUBLISHED

axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Assigner: VulnCheck
Reserved: 29.07.2026 Published: 01.08.2026 Updated: 01.08.2026

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.3

Product Status

Vendor axios
Product axios
Versions Default: unaffected
  • affected from 0.28.0 to 1.18.0 (excl.)
  • Version 1.18.0 is unaffected

Credits

  • alcls01111 reporter

References

Problem Types

  • Uncontrolled Resource Consumption CWE