Resource exhaustion in Axios
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When…
Vulnerability class: DoS (Denial of Service)
Affected products
- Axios — versions 0.28.0, 0.33.0, 1.0.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)