CVE-2026-67313

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67313
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67313.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67313
Aliases
Downstream
Published
2026-08-01T12:22:16.493Z
Modified
2026-08-03T03:30:34.002362540Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Details

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67313.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/axios/axios

Affected ranges

Type
GIT
Repo
https://github.com/axios/axios
Events
Introduced
3b7635aefc842c05da0ec8c90e8bd09cb54616b8
Fixed
2d06f96e8602c2db13b65a26340ee4a1bbc0b61f
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.28.0"
        },
        {
            "fixed": "1.18.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67313.json"