Vulnerability Description
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Related Weaknesses (CWE)
References
- https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdata
- https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
FAQ
What is CVE-2026-67313?
CVE-2026-67313 is a documented vulnerability. axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field name...
How severe is CVE-2026-67313?
CVSS scoring is not yet available for CVE-2026-67313. Check NVD for updates.
Is there a patch for CVE-2026-67313?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.