Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-67321

axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

axios axios

Default version status: unaffected

  • 0.31.1 to < 0.33.0affected
  • 0.33.0unaffected
pkg:npm/axios

axios axios

Default version status: unaffected

  • 1.15.1 to < 1.18.0affected
  • 1.18.0unaffected
pkg:npm/axios

References