{"id":"CVE-2026-67321","title":"axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'","summary":"axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serializati…","severity":"medium","cwe":["CWE-674","CWE-770"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass","label":"disclosure@vulncheck.com"},{"url":"https://github.com/axios/axios/pull/11000"},{"url":"https://github.com/axios/axios/pull/11001"},{"url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"},{"url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"url":"https://github.com/axios/axios/releases/tag/v0.33.0"},{"url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69125"},{"url":"https://github.com/advisories/GHSA-hcpx-6fm6-wx23"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67321.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67321"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510011"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67321"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:47619"},{"url":"https://access.redhat.com/errata/RHSA-2026:48241"},{"url":"https://access.redhat.com/errata/RHSA-2026:48758"},{"url":"https://access.redhat.com/errata/RHSA-2026:59566"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:65514"},{"url":"https://access.redhat.com/errata/RHSA-2026:63373"},{"url":"https://access.redhat.com/errata/RHSA-2026:63355"},{"url":"https://access.redhat.com/errata/RHSA-2026:66084"},{"url":"https://access.redhat.com/errata/RHSA-2026:66523"},{"url":"https://access.redhat.com/errata/RHSA-2026:67711"},{"url":"https://access.redhat.com/errata/RHSA-2026:67714"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:68765"},{"url":"https://access.redhat.com/errata/RHSA-2026:68748"},{"url":"https://access.redhat.com/errata/RHSA-2026:68755"}],"tags":["nvd","ghsa","npm","csaf","vex","red-hat"],"ingestedAt":"2026-08-02T07:18:02.106Z","epss":0.0036,"epssPercentile":0.29658,"aliases":["GHSA-hcpx-6fm6-wx23"],"ecosystem":"npm","vendor":"axios","product":"axios","affected":["axios >= 0.31.1, < 0.33.0","axios >= 1.15.1, < 1.18.0"],"patched":["axios 0.33.0","axios 1.18.0"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-67321","body":"## Overview\n\naxios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-67321)\n\nAffected packages:\n\n- `axios >= 0.31.1, < 0.33.0`\n- `axios >= 1.15.1, < 1.18.0`\n\nPatched in:\n\n- `axios 0.33.0`\n- `axios 1.18.0`\n\nSource: https://github.com/advisories/GHSA-hcpx-6fm6-wx23\n\n## Vendor advisories\n\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:47619** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47619)\n- **RHSA-2026:48241** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48241)\n- **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758)\n- **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566)\n- **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583)\n- **RHSA-2026:65514** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65514)\n- **RHSA-2026:63373** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63373)\n- **RHSA-2026:63355** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63355)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67321.json)\n- **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084)\n- **RHSA-2026:66523** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66523)\n- **RHSA-2026:67711** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67711)\n- **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)","depth":"sunlit","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201867,"id":"CVE-2026-67321","ts":1789399915734,"field":"cvss","old":null,"new":"7.5"},{"seq":200597,"id":"CVE-2026-67321","ts":1789397462946,"field":"cvss","old":"7.5","new":null},{"seq":198514,"id":"CVE-2026-67321","ts":1789392048154,"field":"cvss","old":null,"new":"7.5"},{"seq":196305,"id":"CVE-2026-67321","ts":1789383663535,"field":"cvss","old":"7.5","new":null},{"seq":195234,"id":"CVE-2026-67321","ts":1789380514344,"field":"cvss","old":null,"new":"7.5"},{"seq":194021,"id":"CVE-2026-67321","ts":1789378600068,"field":"cvss","old":"7.5","new":null},{"seq":192808,"id":"CVE-2026-67321","ts":1789376445113,"field":"cvss","old":null,"new":"7.5"},{"seq":191595,"id":"CVE-2026-67321","ts":1789373519399,"field":"cvss","old":"7.5","new":null},{"seq":190380,"id":"CVE-2026-67321","ts":1789369394486,"field":"cvss","old":null,"new":"7.5"},{"seq":189167,"id":"CVE-2026-67321","ts":1789368317305,"field":"cvss","old":"7.5","new":null},{"seq":187950,"id":"CVE-2026-67321","ts":1789365184869,"field":"cvss","old":null,"new":"7.5"},{"seq":186737,"id":"CVE-2026-67321","ts":1789363376033,"field":"cvss","old":"7.5","new":null},{"seq":185523,"id":"CVE-2026-67321","ts":1789361163350,"field":"cvss","old":null,"new":"7.5"},{"seq":184310,"id":"CVE-2026-67321","ts":1789358232676,"field":"cvss","old":"7.5","new":null},{"seq":182561,"id":"CVE-2026-67321","ts":1789354259636,"field":"cvss","old":null,"new":"7.5"},{"seq":181354,"id":"CVE-2026-67321","ts":1789353217747,"field":"cvss","old":"7.5","new":null},{"seq":180147,"id":"CVE-2026-67321","ts":1789350212010,"field":"cvss","old":null,"new":"7.5"},{"seq":178940,"id":"CVE-2026-67321","ts":1789348178252,"field":"cvss","old":"7.5","new":null},{"seq":177733,"id":"CVE-2026-67321","ts":1789346318962,"field":"cvss","old":null,"new":"7.5"},{"seq":176526,"id":"CVE-2026-67321","ts":1789343094078,"field":"cvss","old":"7.5","new":null},{"seq":174643,"id":"CVE-2026-67321","ts":1789334825549,"field":"cvss","old":null,"new":"7.5"},{"seq":173438,"id":"CVE-2026-67321","ts":1789333568589,"field":"cvss","old":"7.5","new":null},{"seq":172252,"id":"CVE-2026-67321","ts":1789331043501,"field":"cvss","old":null,"new":"7.5"},{"seq":171066,"id":"CVE-2026-67321","ts":1789328669733,"field":"cvss","old":"7.5","new":null},{"seq":169861,"id":"CVE-2026-67321","ts":1789327096039,"field":"cvss","old":null,"new":"7.5"},{"seq":168656,"id":"CVE-2026-67321","ts":1789323737311,"field":"cvss","old":"7.5","new":null},{"seq":167451,"id":"CVE-2026-67321","ts":1789319620785,"field":"cvss","old":null,"new":"7.5"},{"seq":166246,"id":"CVE-2026-67321","ts":1789318631504,"field":"cvss","old":"7.5","new":null},{"seq":165041,"id":"CVE-2026-67321","ts":1789315740134,"field":"cvss","old":null,"new":"7.5"},{"seq":163836,"id":"CVE-2026-67321","ts":1789313533667,"field":"cvss","old":"7.5","new":null},{"seq":162631,"id":"CVE-2026-67321","ts":1789311848033,"field":"cvss","old":null,"new":"7.5"},{"seq":161426,"id":"CVE-2026-67321","ts":1789308604911,"field":"cvss","old":"7.5","new":null},{"seq":160931,"id":"CVE-2026-67321","ts":1789304548804,"field":"cvss","old":null,"new":"7.5"},{"seq":160478,"id":"CVE-2026-67321","ts":1789304058671,"field":"cvss","old":"7.5","new":null},{"seq":159539,"id":"CVE-2026-67321","ts":1789300430502,"field":"cvss","old":null,"new":"7.5"},{"seq":156528,"id":"CVE-2026-67321","ts":1789294667571,"field":"cvss","old":"7.5","new":null},{"seq":155323,"id":"CVE-2026-67321","ts":1789292850386,"field":"cvss","old":null,"new":"7.5"},{"seq":154118,"id":"CVE-2026-67321","ts":1789289696476,"field":"cvss","old":"7.5","new":null},{"seq":152768,"id":"CVE-2026-67321","ts":1789281576946,"field":"cvss","old":null,"new":"7.5"},{"seq":152408,"id":"CVE-2026-67321","ts":1789281169673,"field":"cvss","old":"7.5","new":null},{"seq":151369,"id":"CVE-2026-67321","ts":1789277574440,"field":"cvss","old":null,"new":"7.5"},{"seq":150330,"id":"CVE-2026-67321","ts":1789276162668,"field":"cvss","old":"7.5","new":null},{"seq":149297,"id":"CVE-2026-67321","ts":1789273779670,"field":"cvss","old":null,"new":"7.5"},{"seq":148264,"id":"CVE-2026-67321","ts":1789271234653,"field":"cvss","old":"7.5","new":null},{"seq":146297,"id":"CVE-2026-67321","ts":1789269313546,"field":"cvss","old":null,"new":"7.5"},{"seq":145101,"id":"CVE-2026-67321","ts":1789266263191,"field":"cvss","old":"7.5","new":null},{"seq":144005,"id":"CVE-2026-67321","ts":1789262551200,"field":"cvss","old":null,"new":"7.5"},{"seq":142909,"id":"CVE-2026-67321","ts":1789261422614,"field":"cvss","old":"7.5","new":null},{"seq":141740,"id":"CVE-2026-67321","ts":1789258777693,"field":"cvss","old":null,"new":"7.5"},{"seq":140581,"id":"CVE-2026-67321","ts":1789256634522,"field":"cvss","old":"7.5","new":null}]}