CVE-2026-67312

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67312
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67312.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67312
Aliases
Downstream
Published
2026-08-01T12:22:18.102Z
Modified
2026-08-03T03:30:26.726394603Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
Details

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67312.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/axios/axios

Affected ranges

Type
GIT
Repo
https://github.com/axios/axios
Events
Introduced
3b7635aefc842c05da0ec8c90e8bd09cb54616b8
Fixed
d998cc9a1aa5cc45fbdfbdded6e9ecf8beb61aed
Introduced
484aa4fe6addccbd32206a31eb3d2d000843066e
Fixed
2d06f96e8602c2db13b65a26340ee4a1bbc0b61f
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.28.0"
        },
        {
            "fixed": "0.33.0"
        },
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.18.0"
        }
    ]
}

Affected versions

1.*
1.2.0-alpha.1
1.2.2
v0.*
v0.28.0
v0.28.1
v0.29.0
v0.30.0
v0.30.1
v0.30.2
v0.30.3
v0.31.0
v0.31.1
v0.32.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.14.0
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.17.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.7.0
v1.7.0-beta.0
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67312.json"