CVE-2026-67321CWE-674

CVE-2026-67321

High · published August 1, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00534 · 44.0th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-08-01T17:17Z
Affected products (2)
ProductVersionsFixed in
axios/axios≥ 0.31.1, < 0.33.00.33.0
axios/axios≥ 1.15.1, < 1.18.01.18.0
References (3)
https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23 · [email protected]https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass · [email protected]https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
    cvelistv5