--- id: CVE-2026-67313 title: >- axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments summary: >- axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brac… severity: high cwe: - CWE-400 - CWE-674 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67313' references: - url: 'https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3' label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson label: disclosure@vulncheck.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67313.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67313' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510017' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67313' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67313' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:49714' - url: 'https://access.redhat.com/errata/RHSA-2026:48758' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://access.redhat.com/errata/RHSA-2026:59548' - url: 'https://access.redhat.com/errata/RHSA-2026:59561' - url: 'https://access.redhat.com/errata/RHSA-2026:59554' - url: 'https://access.redhat.com/errata/RHSA-2026:59566' - url: 'https://access.redhat.com/errata/RHSA-2026:59583' - url: 'https://access.redhat.com/errata/RHSA-2026:65514' - url: 'https://access.redhat.com/errata/RHSA-2026:63373' - url: 'https://access.redhat.com/errata/RHSA-2026:63355' - url: 'https://access.redhat.com/errata/RHSA-2026:66084' - url: 'https://access.redhat.com/errata/RHSA-2026:66523' tags: - nvd - csaf - vex - red-hat ingestedAt: '2026-08-02T07:18:01.810Z' epss: 0.00433 epssPercentile: 0.37103 vendor: Red Hat product: Red Hat OpenShift AI 2.25 affected: - migration_toolkit_for_applications 8 - migration_toolkit_for_containers - multicluster_engine_for_kubernetes - network_observability_operator - openshift_pipelines - advanced_cluster_security 4 - ansible_automation_platform 2 - build_of_apicurio_registry 3 - data_grid 8 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_dev_spaces - openshift_virtualization 4 - quay 3 - satellite 6 - trusted_profile_analyzer - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - hardened_images - openshift_ai 2.25 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.9 - satellite 6.18 - satellite 6.19 patched: - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - hardened_images - openshift_ai 2.25 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.9 - satellite 6.18 - satellite 6.19 cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor --- ## Overview axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:49714** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49714) - **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:59548** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59548) - **RHSA-2026:59561** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59561) - **RHSA-2026:59554** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.2 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59554) - **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566) - **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583) - **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Migration Toolkit for Containers, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Data Grid 8, Red Hat Trusted Profile Analyzer, Migration Toolkit for Applications 8, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67313.json)