Junglewise Threat Intelligence

CVE-2026-67313: axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bra

CVE-2026-67313 · Severity: high · CVSS 7.5 · Published 2026-08-01

Technologies: Axios. Vendors: Axios.

Executive brief

Axios is an HTTP client library widely used in Node.js and browser applications. The formDataToJSON function, which converts form data to JSON format, can be exploited by supplying form field names with thousands of nested bracket segments, causing excessive recursion that exhausts the JavaScript call stack and crashes the process. Applications that accept untrusted form field names and convert them to JSON using axios are at risk of denial of service.

Technical details

The vulnerability exists in lib/helpers/formDataToJSON.js, which recursively processes FormData field names via the buildPath() function. When a field name contains thousands of bracket segments (e.g., "a[x][x][x]..." repeated 15000 times), each bracket creates a new recursive call to buildPath() without depth checking. At sufficient recursion depth, the V8 JavaScript engine throws RangeError: Maximum call stack size exceeded. The vulnerable code path is triggered when: (1) axios.formToJSON(formData) is called directly with untrusted input, or (2) FormData is sent via axios as JSON (Content-Type: application/json). The error occurs before network I/O, returned as a rejected Promise or thrown synchronously. Axios already guards the inverse operation (toFormData) with a maxDepth limit of 100, but formDataToJSON lacked equivalent protection. The patch (v1.18.0+) adds recursion depth enforcement.

Affected products

  • Axios axios >=0.28.0, <1.18.0

Timeline

  • 2026-07-20: disclosed: Advisory GHSA-42h9-826w-cgv3 published
  • 2026-06-11: patched: Fix merged in PR #11000 (v1.x branch) and PR #11001 (v0.x branch) with depth protection for formDataToJSON
  • 2026-07-06: other: Advisory published on GitHub by jasonsaayman

References

Related threats