Resource exhaustion in Axios
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.004 (36.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Axios — versions 0.28.0, 0.33.0, 1.0.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Exploit, vendor-advisory, Mitigation, Vendor Advisory)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-67312?
- CVE-2026-67312 is a high-severity vulnerability in Axios, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-08-01.
- How severe is CVE-2026-67312?
- High severity. CVSS v3 base score is 7.5 out of 10.