CVE-2026-67321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67321
Aliases
Downstream
Published
2026-08-01T12:22:18.177Z
Modified
2026-08-04T11:31:04.798187793Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Details

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Database specific 
{
    "cwe_ids": [
        "CWE-674"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67321.json"
}
References

Affected packages

Git / github.com/axios/axios

Affected ranges

Type
GIT
Repo
https://github.com/axios/axios
Events
Introduced
a589dc525af12e0fabef7d6e5be028ad433eee31
Fixed
d998cc9a1aa5cc45fbdfbdded6e9ecf8beb61aed
Introduced
ac42446be51300fe214ba3c6e40cc95f34fd6871
Fixed
2d06f96e8602c2db13b65a26340ee4a1bbc0b61f
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.31.1"
        },
        {
            "fixed": "0.33.0"
        },
        {
            "introduced": "1.15.1"
        },
        {
            "fixed": "1.18.0"
        }
    ]
}

Affected versions

v0.*
v0.31.1
v0.32.0
v1.*
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.17.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67321.json"