7.5

CVE-2026-67313: axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Analyzed
AliasesUBUNTU-CVE-2026-67313DEBIAN-CVE-2026-67313CGA-2p8f-wqh7-cv3w
Published 01-08-2026Last modified 03-08-2026

Vulnerability summary

CVE-2026-67313 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in axios. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 1 · Downstream 4 · Duplicates 1 · Related 2
GHSA-FQ2J-3J99-RX65OPENSUSE-SU-2026:11680-1RHSA-2026:48758RHSA-2026:49714RHSA-2026:50826CVE-2026-68942

Timeline

  1. 01-08-2026
    PublishedVulnerability first disclosed.
  2. 03-08-2026
    Last modifiedVulnerability information updated.

Description

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard70 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.5-r14
  • awx< 24.6.1-r45
  • azurite< 3.35.0-r2
Wolfi10 products
  • jitsucom-jitsu-console< 2.11.0-r30
  • kubeflow-centraldashboard< 1.10.0-r26
  • langfuse-3< 3.223.0-r0
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.223.0-r0
Axios1 product
  • axios≥ 0.28.0, < 1.18.0
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.18.0-1
Npm1 product
  • axios≥ 0.28.0, < 0.33.0 | ≥ 1.0.0, < 1.18.0
Ubuntu1 product
  • node-axiosAll versions (No fix recorded)

6 vendors · 84 products

References

15 links
Show all 15 references