CVE-2026-67321

Name of the Vulnerable Software and Affected Versions axios versions 0.31.1 through 0.32.x axios versions 1.15.1 through 1.17.x

Description An incomplete depth-limit bypass exists in lib/helpers/toFormData.js when serializing objects with top-level keys ending in {}. When such a key is present, the software calls JSON.stringify() on the value before the formSerializer.maxDepth guard can inspect the nested structure. An attacker who controls object keys and nested values passed to axios form or parameter serialization can trigger a RangeError (Maximum call stack size exceeded), leading to a denial of service in the affected request path.

This issue affects the following components:

Recommendations Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary workaround, reject or depth-limit untrusted objects before passing them to axios serialization. Strip or reject top-level keys ending in {} from untrusted objects when using axios form serialization. For query parameters, use a custom paramsSerializer.serialize that enforces a depth limit. For form bodies, construct FormData or URLSearchParams manually after validating input depth.