Vulnerability Description
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
Related Weaknesses (CWE)
References
- https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojs
- https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
FAQ
What is CVE-2026-67312?
CVE-2026-67312 is a documented vulnerability. axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with...
How severe is CVE-2026-67312?
CVSS scoring is not yet available for CVE-2026-67312. Check NVD for updates.
Is there a patch for CVE-2026-67312?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.