CVE-2026-67312: axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.33.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67312?
CVE-2026-67312 has a risk rating of 28, indicating a moderate to high severity level.
How do I fix CVE-2026-67312?
To fix CVE-2026-67312, upgrade axios to version 0.33.0 or later, or 1.18.0 or later.
What does CVE-2026-67312 exploit?
CVE-2026-67312 exploits uncontrolled recursion in the formDataToJSON function of axios, leading to potential Denial of Service.
Which versions of axios are affected by CVE-2026-67312?
CVE-2026-67312 affects axios versions 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0.
What are the potential consequences of CVE-2026-67312?
The exploitation of CVE-2026-67312 may result in a Denial of Service, making applications using axios unresponsive.