Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67313axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Medium 6.3

In plain English

A medium-severity uncontrolled resource consumption in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-axios	no fix listed	DEBIAN-CVE-2026-67313
Debian:13	node-axios	no fix listed	DEBIAN-CVE-2026-67313
Debian:14	node-axios	1.18.0-1	DEBIAN-CVE-2026-67313
npm	axios	0.33.0	GHSA-42h9-826w-cgv3
npm	axios	1.18.0	GHSA-42h9-826w-cgv3

Affected products (as reported)

Vendor	Product	Versions
axios	axios	0.28.0 – before 1.18.0

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-42h9-826w-cgv3) vendor-advisory
VulnCheck Advisory: axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON third-party-advisory