CVE-2026-67313CWE-400denial-of-service

CVE-2026-67313

High · published August 1, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-01T17:17Z
Affected products (1)
ProductVersionsFixed in
axios/axios≥ 0.28.0, < 1.18.01.18.0
References (3)
https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 · [email protected]https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson · [email protected]https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
    cvelistv5