CVE-2026-67313

Name of the Vulnerable Software and Affected Versions axios versions 0.28.0 and later

Description Uncontrolled recursion exists in the formDataToJSON function when processing FormData field names containing deeply nested bracket segments. An attacker can provide FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack, triggering a RangeError. This leads to request failure or process termination in applications that do not handle the exception, resulting in a denial of service. This issue affects the axios.formToJSON(formData) API, the formToJSON import, the lib/helpers/formDataToJSON.js file, and the default transformRequest when FormData is sent with an application/json content type. The vulnerability is triggered via the buildPath() function, which recursively processes path segments without enforcing a maximum depth.

Recommendations For axios versions 0.28.0 and later, validate FormData field names to reject keys whose nesting depth exceeds the expected schema before calling formToJSON() or sending FormData with Content-Type: application/json. For axios requests carrying untrusted FormData, avoid setting Content-Type: application/json to bypass the formDataToJSON() process. As a temporary mitigation, implement error handling to catch the resulting RangeError to prevent full process termination.