{"id":"CVE-2026-67312","title":"axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json)","summary":"axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). Whe…","severity":"high","cwe":["CWE-400","CWE-674"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67312.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67312"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510007"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67312"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312"},{"url":"https://access.redhat.com/errata/RHSA-2026:62851"},{"url":"https://access.redhat.com/errata/RHSA-2026:69248"},{"url":"https://access.redhat.com/errata/RHSA-2026:47619"},{"url":"https://access.redhat.com/errata/RHSA-2026:48241"},{"url":"https://access.redhat.com/errata/RHSA-2026:48758"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-02T07:18:01.778Z","epss":0.00433,"epssPercentile":0.36964,"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["openshift_pipelines","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_dev_spaces","trusted_profile_analyzer","developer_hub 1.10","developer_hub 1.9","hardened_images","openshift_dev_spaces 3.30"],"patched":["developer_hub 1.10","developer_hub 1.9","hardened_images","openshift_dev_spaces 3.30"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-67312","body":"## Overview\n\naxios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:62851** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62851)\n- **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248)\n- **RHSA-2026:47619** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47619)\n- **RHSA-2026:48241** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48241)\n- **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)\n- **Red Hat VEX** · Important · affected: OpenShift Pipelines, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Trusted Profile Analyzer · no fix planned: OpenShift Pipelines, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67312.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208472,"id":"CVE-2026-67312","ts":1790005711238,"field":"cvss","old":null,"new":"7.5"},{"seq":208471,"id":"CVE-2026-67312","ts":1790005711238,"field":"severity","old":"none","new":"high"}]}