{"id":"GHSA-3mcp-22mf-vrw3","title":"Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken","summary":"Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken","severity":"medium","cvss":7.5,"cwe":["CWE-674"],"vendor":"axios","product":"axios","ecosystem":"npm","affected":["axios >= 1.15.1, < 1.18.0"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T17:16:46Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-3mcp-22mf-vrw3","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67321"},{"url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"},{"url":"https://github.com/advisories/GHSA-3mcp-22mf-vrw3"}],"tags":["ghsa","npm"],"ingestedAt":"2026-09-08T18:07:34.882Z","slug":"GHSA-3mcp-22mf-vrw3","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hcpx-6fm6-wx23. This link is maintained to preserve external references.\n\n## Original Description\naxios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.\n\n## Affected packages\n\n- `axios >= 1.15.1, < 1.18.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}