7.5

CVE-2026-67312: axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

Analyzed
AliasesUBUNTU-CVE-2026-67312DEBIAN-CVE-2026-67312CGA-26x6-r43w-qm9m
Published 01-08-2026Last modified 29-10-2026

Vulnerability summary

CVE-2026-67312 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in axios. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 1 · Downstream 3 · Duplicates 1 · Related 1
GHSA-4WW2-RJH2-XPV9RHSA-2026:47619RHSA-2026:48241RHSA-2026:48758CVE-2026-68941CGA-9G5W-43CC-7RWX

Timeline

  1. 01-08-2026
    PublishedVulnerability first disclosed.
  2. 29-10-2026
    Last modifiedVulnerability information updated.

Description

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard70 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.5-r14
  • awx< 24.6.1-r45
  • azurite< 3.35.0-r2
Wolfi10 products
  • jitsucom-jitsu-console< 2.11.0-r30
  • kubeflow-centraldashboard< 1.10.0-r26
  • langfuse-3< 3.223.0-r0
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.223.0-r0
Axios1 product
  • axios≥ 0.28.0, < 0.33.0 | ≥ 1.0.0, < 1.18.0
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.18.0-1
Npm1 product
  • axios≥ 0.28.0, < 0.33.0 | ≥ 1.0.0, < 1.18.0
Opensuse1 product
  • python-nbdime&distro=openSUSE Tumbleweed< 4.0.4-24.1
Ubuntu1 product
  • node-axiosAll versions (No fix recorded)

7 vendors · 85 products

References

16 links
Show all 16 references