CVE-2026-67313
Aliases:UBUNTU-CVE-2026-67313DEBIAN-CVE-2026-67313GHSA-42h9-826w-cgv3CGA-5qr7-c576-cfwgCGA-6fq6-84hv-f54wCGA-6r6m-fcpq-p28cCGA-6v44-mg8h-jw27CGA-9m48-jhhj-grr2CGA-c33q-2536-3m94CGA-fxwg-grmf-2vcmCGA-h65g-g6rx-w8j5CGA-m2hv-6fjg-phjcCGA-m998-jhcw-56pxCGA-prpf-2jvr-6x3wCGA-23qx-v32v-q82xCGA-24rj-583q-r7m7CGA-252p-232m-wqr2CGA-292g-frrc-rj7qCGA-29qm-mx3h-8xfxCGA-29v2-3vx5-ggx2CGA-2c74-42g7-mgq7CGA-2c8x-8jmx-ch5cCGA-2fgc-5xr8-xm7cCGA-2gjf-9m3w-vv6pCGA-2j94-585j-qxjhCGA-2j98-mg5p-xvw6CGA-2jjm-8gmc-rjj9CGA-2pfv-h7c2-pvwvCGA-2q5c-3927-qx33CGA-2w4q-65fx-7347CGA-33jh-w7mh-7xh4CGA-3cmx-8c5g-v4f9CGA-3m83-7gf8-48gxCGA-3p5j-fx7w-54r3CGA-3pmw-93r6-3xg9CGA-3qjx-r59c-8mw7CGA-42vr-62ww-qwjgCGA-44jw-4qgp-fw5gCGA-454x-v23q-43rxCGA-45rh-9w4x-f782CGA-46wv-8jr2-j45rCGA-4fff-c3mm-g47xCGA-4ghx-whww-69p9CGA-4m34-4w9p-j33gCGA-4mcg-7vv7-j79pCGA-4vcr-483g-9pwwCGA-57g9-52hf-xmh5CGA-59cj-cr55-f62jCGA-5f45-9v8p-hpc9CGA-5fmc-4hqv-8vx5CGA-5jmv-wx69-86fwCGA-5m55-c99m-r67rCGA-5mcm-7gvq-5wf3CGA-5rvc-j8wf-v35rCGA-5wwh-555v-g62qCGA-6729-wmvv-jmh4CGA-686g-xr5g-jj25CGA-69jr-9v2x-xg3qCGA-6f45-x7pq-p64fCGA-6gr5-xpcc-cq7cCGA-6h9g-5v3v-gx6xCGA-6j77-gxqp-92pvCGA-6qg6-v4jf-9xj7CGA-6rrw-g247-hp7cCGA-73j9-6wh8-mp6mCGA-756c-h9hh-j45vCGA-757g-cv5j-wwgpCGA-762r-m8q4-6rrrCGA-7662-86mx-7fv5CGA-7785-m9m6-cgw8CGA-77jh-cg2v-2gp7CGA-793w-g5q6-3xvmCGA-7m4v-xmwv-6rx7CGA-7mcx-5r82-8wqhCGA-7mjj-g445-q23gCGA-7qf4-98qf-mhfvCGA-7wpj-99f6-mj3hCGA-82hw-3fv9-4p7hCGA-82vg-3g9j-67c9CGA-849c-87qg-gfjxCGA-872g-fc7g-3v23CGA-88ww-f3c7-fr6rCGA-8pxv-r875-f7p7CGA-93m6-2qr8-vv5mCGA-94m3-j538-6vhcCGA-99cr-hv52-77c5CGA-9fw3-pg69-fhcgCGA-c62g-4gfj-7w2mCGA-cgf3-rgg4-mq3gCGA-ch42-63f2-2fvqCGA-cjg7-5v3q-33rcCGA-cjwg-v5vq-fx43CGA-cvww-r9p8-p9f2CGA-f3jq-39p2-55rvCGA-f5qg-hwqm-9xm7CGA-ff9v-cpfg-fp6mCGA-ffh6-gvwq-mr7vCGA-fm57-xfjw-47f8CGA-fqvf-79wh-62j6CGA-fqx2-f57p-pf6gCGA-fvj9-8vm7-gf5pCGA-g2jg-q88w-vr8xCGA-g3pg-3g2h-rcf6CGA-g68p-74j5-g5v9CGA-g8x2-jxc6-rf4pCGA-gmh7-hvrg-qfp5CGA-gmj4-7w7r-42chCGA-gqhf-jf27-p4wwCGA-gwp7-pmp3-qq8hCGA-gxhq-g472-553gCGA-h98g-mh3r-9h52CGA-hgg7-3g3w-cprfCGA-hhw4-w9m6-6cmqCGA-hv8v-xvqq-h4hcCGA-hwmr-xh34-h284CGA-j2x5-m7hj-9gcgCGA-j999-pcxr-qv3xCGA-jg7w-vmmq-qvrmCGA-jq6c-wrhx-j7hrCGA-jqr6-9qhm-9rjwCGA-m78h-xv3r-h95pCGA-mc39-qjc2-fv82CGA-mx4v-rr6c-q2cmCGA-p2m4-7x8r-jf5gCGA-p37v-fxgh-gvc9CGA-p47f-mrv9-4frhCGA-p6j2-jx4m-3fj2CGA-p75r-fq56-462wCGA-p767-v3rw-pp9pCGA-pj4c-wm4j-4c7jCGA-ppfj-c3q3-55fmCGA-ppr4-qp32-hmwjCGA-q97v-7j7j-chhxCGA-qcxp-x69w-pvq4CGA-qgw9-8335-p78jCGA-qh93-457q-4qj3CGA-qjf2-f3mv-4fp6CGA-qjmm-jg6j-3j9mCGA-qmhv-899m-prhjCGA-qwqr-97c2-7cf8CGA-qxxp-584c-7gwmCGA-r2gx-83fj-mc5wCGA-r3j8-gmrv-hj25CGA-r54c-mqr2-w688CGA-r792-g2wr-mh3mCGA-r879-584w-6rhcCGA-r895-4mrg-c846CGA-rfjr-32qr-4jvfCGA-rg4h-495g-vx3xCGA-rhvq-82wc-7qgjCGA-rhvv-hjq5-vrcvCGA-rq7r-mxwp-q2x4CGA-rr5f-xxjf-jjgwCGA-rr89-wj63-4hqjCGA-rrrw-v3j7-487fCGA-rxvq-97w2-xppcCGA-v2w9-mvh4-x87gCGA-v37q-5wcr-mwc4CGA-v38j-p25m-w96rCGA-v7h7-vwhw-wfxgCGA-v7hj-75h6-wvxrCGA-v9jv-378w-f7ppCGA-vf66-qf3r-4vvvCGA-vjh4-xqcx-r9vmCGA-vjj2-vq98-c7hmCGA-vjrx-v5pq-pg3xCGA-vmpg-gfxc-3xf7CGA-vmq5-jr5j-jq52CGA-vw95-6chm-6vrhCGA-vwcr-3x4j-c5qpCGA-vxvw-4x6m-g38gCGA-w669-g7hj-4mg3CGA-w86j-g5hv-3c9xCGA-w8gj-4wqr-mc77CGA-w9ph-rxfr-8864CGA-wc7c-6p56-5wxjCGA-wfjq-jvcx-wxfmCGA-wg9q-h637-526wCGA-wp46-343p-h8hcCGA-wpm6-m3f5-h83gCGA-wqph-6wp6-6p7cCGA-wqwg-vp3v-x96rCGA-x5jx-xffm-q8j5CGA-x67j-fqc4-m8rvCGA-x684-28xm-5qfgCGA-x77p-w5x4-2xpcCGA-xpf9-xwq2-g7cqCGA-xvc7-7vf6-83c7CGA-xw45-ghc6-g9mwCGA-xxfv-9qm6-65g9CGA-2p8f-wqh7-cv3w
Advisory lineage Upstream: 2 Downstream: 4
Analyzed
Published: 01 Aug 2026, 12:22
Last modified:03 Aug 2026, 19:30
Vulnerability Summary
Overall Risk (default)
medium
40/100 CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.43% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
01 Aug 2026, 12:22
Published
Vulnerability first disclosed
03 Aug 2026, 19:30
Last Modified
Vulnerability information updated
Description
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
CVSS Metrics
- v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.43%• Percentile: 37%
Techniques & Countermeasures
- CWE-400•Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Affected Systems
- chainguard•airflow-2
all
- chainguard•airflow-core-2
all
- chainguard•arangodb-3.11
< 3.11.14.5-r14
- chainguard•awx
< 24.6.1-r45
- chainguard•azurite
< 3.35.0-r2
- chainguard•gitlab-rails-ce-18.1
all
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
all
- chainguard•gitlab-rails-ce-19.1
all | < 19.1.7-r6
- chainguard•gitlab-rails-ce-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-19.3
< 19.3.1-r6
- chainguard•gitlab-rails-ce-fips-18.1
all
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
all
- chainguard•gitlab-rails-ce-fips-19.1
all | < 19.1.7-r7
- chainguard•gitlab-rails-ce-fips-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-fips-19.3
< 19.3.1-r3
- chainguard•jitsucom-jitsu-console
< 2.11.0-r30
- chainguard•kibana-8.17
< 8.17.10-r31
- chainguard•kibana-8.17-bitnami
< 8.17.10-r31
- chainguard•kibana-8.17-iamguarded
< 8.17.10-r31
- chainguard•kibana-8.19
< 8.19.18-r2
- chainguard•kibana-8.19-bitnami
< 8.19.18-r2
- chainguard•kibana-8.19-iamguarded
< 8.19.18-r2
- chainguard•kibana-9.0
< 9.0.8-r34
- chainguard•kibana-9.0-bitnami
< 9.0.8-r34
- chainguard•kibana-9.0-iamguarded
< 9.0.8-r34
- chainguard•kibana-9.1
< 9.1.10-r30
- chainguard•kibana-9.1-iamguarded
< 9.1.10-r30
- chainguard•kibana-9.2
< 9.2.8-r18
- chainguard•kibana-9.2-iamguarded
< 9.2.8-r18
- chainguard•kibana-9.3
< 9.3.8-r1
- chainguard•kibana-9.3-iamguarded
< 9.3.8-r1
- chainguard•kibana-9.4
< 9.4.4-r3
- chainguard•kibana-9.4-iamguarded
< 9.4.4-r3
- chainguard•kubeflow-centraldashboard
< 1.10.0-r26
- chainguard•langfuse-2
< 2.95.12-r35
- chainguard•langfuse-2-worker
< 2.95.12-r35
- chainguard•langfuse-3
< 3.223.0-r0
- chainguard•langfuse-3-compat
< 3.225.7-r6
- chainguard•langfuse-3-worker
< 3.223.0-r0
- chainguard•langfuse-fips-2
< 2.95.12-r38
Showing first 50 affected entries in server-rendered view.
References (15)
- https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson
- https://ubuntu.com/security/CVE-2026-67313
- https://www.cve.org/CVERecord?id=CVE-2026-67313
- https://security-tracker.debian.org/tracker/CVE-2026-67313
- https://github.com/axios/axios/pull/11000
- https://github.com/axios/axios/pull/11001
- https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
- https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-67313
- https://nvd.nist.gov/vuln/detail/CVE-2026-68942
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67313.json