CVE-2026-67313: axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67313?
The severity of CVE-2026-67313 is classified as medium with a CVSS score of 6.3.
How do I fix CVE-2026-67313?
To fix CVE-2026-67313, upgrade axios to version 1.18.0 or later.
What type of vulnerability is CVE-2026-67313?
CVE-2026-67313 is a Denial of Service vulnerability related to uncontrolled recursion in formDataToJSON.
What versions of axios are affected by CVE-2026-67313?
CVE-2026-67313 affects axios versions 0.28.0 and later, prior to 1.18.0.
How can attackers exploit CVE-2026-67313?
Attackers can exploit CVE-2026-67313 by supplying FormData with field names containing deeply nested bracket segments to exhaust the JavaScript call stack.