{"id":"CVE-2026-67313","title":"axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments","summary":"axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brac…","severity":"high","cwe":["CWE-400","CWE-674"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67313","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67313.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67313"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510017"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67313"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67313"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:49714"},{"url":"https://access.redhat.com/errata/RHSA-2026:48758"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:59548"},{"url":"https://access.redhat.com/errata/RHSA-2026:59561"},{"url":"https://access.redhat.com/errata/RHSA-2026:59554"},{"url":"https://access.redhat.com/errata/RHSA-2026:59566"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:65514"},{"url":"https://access.redhat.com/errata/RHSA-2026:63373"},{"url":"https://access.redhat.com/errata/RHSA-2026:63355"},{"url":"https://access.redhat.com/errata/RHSA-2026:66084"},{"url":"https://access.redhat.com/errata/RHSA-2026:66523"}],"tags":["nvd","csaf","vex","red-hat"],"ingestedAt":"2026-08-02T07:18:01.810Z","epss":0.00433,"epssPercentile":0.36964,"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","affected":["migration_toolkit_for_applications 8","migration_toolkit_for_containers","multicluster_engine_for_kubernetes","network_observability_operator","openshift_pipelines","advanced_cluster_security 4","ansible_automation_platform 2","build_of_apicurio_registry 3","data_grid 8","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_dev_spaces","openshift_virtualization 4","quay 3","satellite 6","trusted_profile_analyzer","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","ansible_automation_platform 2.1","hardened_images","openshift_ai 2.25","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.9","satellite 6.18","satellite 6.19"],"patched":["advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","ansible_automation_platform 2.1","hardened_images","openshift_ai 2.25","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.9","satellite 6.18","satellite 6.19"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-67313","body":"## Overview\n\naxios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:49714** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49714)\n- **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:59548** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59548)\n- **RHSA-2026:59561** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59561)\n- **RHSA-2026:59554** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.2 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59554)\n- **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566)\n- **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Migration Toolkit for Containers, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Red Hat Trusted Profile Analyzer, Migration Toolkit for Applications 8, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67313.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201862,"id":"CVE-2026-67313","ts":1789399915483,"field":"cvss","old":null,"new":"7.5"},{"seq":201861,"id":"CVE-2026-67313","ts":1789399915483,"field":"severity","old":"none","new":"high"},{"seq":200592,"id":"CVE-2026-67313","ts":1789397462869,"field":"cvss","old":"7.5","new":null},{"seq":200591,"id":"CVE-2026-67313","ts":1789397462869,"field":"severity","old":"high","new":"none"},{"seq":198509,"id":"CVE-2026-67313","ts":1789392048090,"field":"cvss","old":null,"new":"7.5"},{"seq":198508,"id":"CVE-2026-67313","ts":1789392048090,"field":"severity","old":"none","new":"high"},{"seq":196300,"id":"CVE-2026-67313","ts":1789383663468,"field":"cvss","old":"7.5","new":null},{"seq":196299,"id":"CVE-2026-67313","ts":1789383663468,"field":"severity","old":"high","new":"none"},{"seq":195229,"id":"CVE-2026-67313","ts":1789380514284,"field":"cvss","old":null,"new":"7.5"},{"seq":195228,"id":"CVE-2026-67313","ts":1789380514284,"field":"severity","old":"none","new":"high"},{"seq":194016,"id":"CVE-2026-67313","ts":1789378600003,"field":"cvss","old":"7.5","new":null},{"seq":194015,"id":"CVE-2026-67313","ts":1789378600003,"field":"severity","old":"high","new":"none"},{"seq":192803,"id":"CVE-2026-67313","ts":1789376445047,"field":"cvss","old":null,"new":"7.5"},{"seq":192802,"id":"CVE-2026-67313","ts":1789376445047,"field":"severity","old":"none","new":"high"},{"seq":191590,"id":"CVE-2026-67313","ts":1789373519335,"field":"cvss","old":"7.5","new":null},{"seq":191589,"id":"CVE-2026-67313","ts":1789373519335,"field":"severity","old":"high","new":"none"},{"seq":190375,"id":"CVE-2026-67313","ts":1789369394420,"field":"cvss","old":null,"new":"7.5"},{"seq":190374,"id":"CVE-2026-67313","ts":1789369394420,"field":"severity","old":"none","new":"high"},{"seq":189162,"id":"CVE-2026-67313","ts":1789368317238,"field":"cvss","old":"7.5","new":null},{"seq":189161,"id":"CVE-2026-67313","ts":1789368317238,"field":"severity","old":"high","new":"none"},{"seq":187945,"id":"CVE-2026-67313","ts":1789365184796,"field":"cvss","old":null,"new":"7.5"},{"seq":187944,"id":"CVE-2026-67313","ts":1789365184796,"field":"severity","old":"none","new":"high"},{"seq":186732,"id":"CVE-2026-67313","ts":1789363375968,"field":"cvss","old":"7.5","new":null},{"seq":186731,"id":"CVE-2026-67313","ts":1789363375968,"field":"severity","old":"high","new":"none"},{"seq":185518,"id":"CVE-2026-67313","ts":1789361163278,"field":"cvss","old":null,"new":"7.5"},{"seq":185517,"id":"CVE-2026-67313","ts":1789361163278,"field":"severity","old":"none","new":"high"},{"seq":184305,"id":"CVE-2026-67313","ts":1789358232613,"field":"cvss","old":"7.5","new":null},{"seq":184304,"id":"CVE-2026-67313","ts":1789358232613,"field":"severity","old":"high","new":"none"},{"seq":182556,"id":"CVE-2026-67313","ts":1789354259574,"field":"cvss","old":null,"new":"7.5"},{"seq":182555,"id":"CVE-2026-67313","ts":1789354259574,"field":"severity","old":"none","new":"high"},{"seq":181349,"id":"CVE-2026-67313","ts":1789353217681,"field":"cvss","old":"7.5","new":null},{"seq":181348,"id":"CVE-2026-67313","ts":1789353217681,"field":"severity","old":"high","new":"none"},{"seq":180142,"id":"CVE-2026-67313","ts":1789350211950,"field":"cvss","old":null,"new":"7.5"},{"seq":180141,"id":"CVE-2026-67313","ts":1789350211950,"field":"severity","old":"none","new":"high"},{"seq":178935,"id":"CVE-2026-67313","ts":1789348178184,"field":"cvss","old":"7.5","new":null},{"seq":178934,"id":"CVE-2026-67313","ts":1789348178184,"field":"severity","old":"high","new":"none"},{"seq":177728,"id":"CVE-2026-67313","ts":1789346318899,"field":"cvss","old":null,"new":"7.5"},{"seq":177727,"id":"CVE-2026-67313","ts":1789346318899,"field":"severity","old":"none","new":"high"},{"seq":176521,"id":"CVE-2026-67313","ts":1789343094012,"field":"cvss","old":"7.5","new":null},{"seq":176520,"id":"CVE-2026-67313","ts":1789343094012,"field":"severity","old":"high","new":"none"},{"seq":174638,"id":"CVE-2026-67313","ts":1789334825483,"field":"cvss","old":null,"new":"7.5"},{"seq":174637,"id":"CVE-2026-67313","ts":1789334825483,"field":"severity","old":"none","new":"high"},{"seq":173433,"id":"CVE-2026-67313","ts":1789333568525,"field":"cvss","old":"7.5","new":null},{"seq":173432,"id":"CVE-2026-67313","ts":1789333568525,"field":"severity","old":"high","new":"none"},{"seq":172247,"id":"CVE-2026-67313","ts":1789331043431,"field":"cvss","old":null,"new":"7.5"},{"seq":172246,"id":"CVE-2026-67313","ts":1789331043431,"field":"severity","old":"none","new":"high"},{"seq":171061,"id":"CVE-2026-67313","ts":1789328669661,"field":"cvss","old":"7.5","new":null},{"seq":171060,"id":"CVE-2026-67313","ts":1789328669661,"field":"severity","old":"high","new":"none"},{"seq":169856,"id":"CVE-2026-67313","ts":1789327095973,"field":"cvss","old":null,"new":"7.5"},{"seq":169855,"id":"CVE-2026-67313","ts":1789327095973,"field":"severity","old":"none","new":"high"}]}