Unrated severityNVD Advisory· Published Aug 2, 2026
Debian node-axios: axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js w…
CVE-2026-67321
Description
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Affected products
2- Range: <0.33.0
Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.