High severity7.5NVD Advisory· Published Aug 1, 2026· Updated Sep 1, 2026
CVE-2026-67321
CVE-2026-67321
Description
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
axiosnpm | >= 0.31.1, < 0.33.0 | 0.33.0 |
axiosnpm | >= 1.15.1, < 1.18.0 | 1.18.0 |
Affected products
4- ghsa-coords2 versions
>= 0.31.1, < 0.33.0+ 1 more
- (no CPE)range: >= 0.31.1, < 0.33.0
- (no CPE)range: < 24+0.a836cced5-52.1
Patches
Vulnerability mechanics
References
11- github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-hcpx-6fm6-wx23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-67321ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-69125ghsaADVISORY
- www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypassnvdThird Party AdvisoryWEB
- github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2dghsaWEB
- github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2ghsaWEB
- github.com/axios/axios/pull/11000ghsaWEB
- github.com/axios/axios/pull/11001ghsaWEB
- github.com/axios/axios/releases/tag/v0.33.0ghsaWEB
- github.com/axios/axios/releases/tag/v1.18.0ghsaWEB
News mentions
0No linked articles in our index yet.