CVE-2026-67321: axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.33.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67321?
CVE-2026-67321 has a risk score of 26, indicating a moderate severity vulnerability.
How do I fix CVE-2026-67321?
To fix CVE-2026-67321, upgrade axios to version 0.33.0 or later to mitigate the denial of service risk.
What systems are affected by CVE-2026-67321?
CVE-2026-67321 affects versions of axios prior to 0.33.0.
What type of vulnerability is CVE-2026-67321?
CVE-2026-67321 is a denial of service vulnerability stemming from an incomplete depth-limit bypass.
How can attackers exploit CVE-2026-67321?
Attackers can exploit CVE-2026-67321 by controlling object keys and nested values passed to axios, leading to a RangeError.