Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a58633dc86e7f0bac16f14361a40e686d84b4b2efe573eb1277c2c219039964d
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","packageURL":"pkg:npm/axios","product":"axios","vendor":"axios","versions":[{"lessThan":"1.18.0","status":"affected","version":"0.28.0","versionType":"semver"},{"status":"unaffected","version":"1.18.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-400","description":"Uncontrolled Resource Consumption","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"GitHub Security Advisory (GHSA-42h9-826w-cgv3)","tags":["vendor-advisory"],"url":"https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/adp/0/references/0
{"name":"VulnCheck Advisory: axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1c4c1b4fb50f983527036c03fd159ffe34d9c8c25aaf4f19d19427eb9616170 · sha256:07d647b0bdc9d24f… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer