GHSA-FQ2J-3J99-RX65

Advisory lineage Upstream: 0 Downstream: 1
Downstream
CVE-2026-67313
Published: 01 Aug 2026, 15:30
Last modified:10 Sept 2026, 03:50

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_npm)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Aug 2026, 15:30
Published
Vulnerability first disclosed
10 Sept 2026, 03:50
Last Modified
Vulnerability information updated

Description

Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42h9-826w-cgv3. This link is maintained to preserve external references. ## Original Description axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

  • Npm•axios

    ≥ 1.0.0

References (3)