Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67321axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

Medium 6.9

In plain English

A medium-severity security flaw in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-axios	no fix listed	DEBIAN-CVE-2026-67321
Debian:13	node-axios	no fix listed	DEBIAN-CVE-2026-67321
Debian:14	node-axios	1.18.0-1	DEBIAN-CVE-2026-67321
npm	axios	0.33.0	GHSA-hcpx-6fm6-wx23
npm	axios	1.18.0	GHSA-hcpx-6fm6-wx23

Affected products (as reported)

Vendor	Product	Versions
axios	axios	0.31.1 – before 0.33.0
axios	axios	1.15.1 – before 1.18.0

Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-hcpx-6fm6-wx23) vendor-advisory
VulnCheck Advisory: axios before 0.33.0 Denial of Service via maxDepth bypass third-party-advisory