Quick answers
- Is CVE-2026-67321 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67321 being exploited in the wild.
- How severe is CVE-2026-67321?
- High severity, with a CVSS score of 7.5, published 1 August 2026.
- Which products and versions are affected?
- Axios >=0.31.1 <0.33.0, >=1.15.1 <1.18.0.
- Is there a fix for CVE-2026-67321?
- A patch was published on 2026-07-20: Patches available in versions 0.33.0+ and 1.18.0+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-67321 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-67321?
- Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a depth-limit bypass in lib/helpers/toFormData.js. When a top-level key ends with '{}', the code calls JSON.stringify() directly on the nested value before the formSerializer.maxDepth guard can validate the structure depth. This allows deeply nested objects to escape the intended ERR_FORM_DATA_DEPTH_EXCEEDED check and instead trigger a native RangeError from JSON.stringify's internal recursion, crashing the process. The attack requires control over both object keys and nested values passed to axios form/parameter serialization functions. The setting formSerializer.metaTokens: false does not mitigate the issue. Patches are available in versions 0.33.0+ and 1.18.0+.
Affected products
- Axios Axios >=0.31.1 <0.33.0, >=1.15.1 <1.18.0
Identifiers
- CVE-2026-67321
- GHSA-hcpx-6fm6-wx23
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Patches available in versions 0.33.0+ and 1.18.0+