CVE-2026-67312

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.

This Important flaw in the axios JavaScript library allows an unauthenticated remote attacker to cause a denial of service. By submitting crafted form data with excessively nested bracket-delimited field names, an attacker can trigger uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally by the default transformRequest when FormData is sent with Content-Type: application/json), exhausting the JavaScript call stack and causing a RangeError that may terminate the application process. This vulnerability affects applications that pass attacker-controlled FormData field names to axios' FormData-to-JSON conversion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to axios >= 1.18.0 (1.x) or >= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.