--- id: CVE-2026-67321 title: >- axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}' summary: >- axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serializati… severity: medium cwe: - CWE-674 - CWE-770 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67321' references: - url: 'https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23' label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass label: disclosure@vulncheck.com - url: 'https://github.com/axios/axios/pull/11000' - url: 'https://github.com/axios/axios/pull/11001' - url: >- https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d - url: >- https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2 - url: 'https://github.com/axios/axios/releases/tag/v0.33.0' - url: 'https://github.com/axios/axios/releases/tag/v1.18.0' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67321' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69125' - url: 'https://github.com/advisories/GHSA-hcpx-6fm6-wx23' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67321.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67321' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510011' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67321' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:47619' - url: 'https://access.redhat.com/errata/RHSA-2026:48241' - url: 'https://access.redhat.com/errata/RHSA-2026:48758' - url: 'https://access.redhat.com/errata/RHSA-2026:59566' - url: 'https://access.redhat.com/errata/RHSA-2026:59583' - url: 'https://access.redhat.com/errata/RHSA-2026:65514' - url: 'https://access.redhat.com/errata/RHSA-2026:63373' - url: 'https://access.redhat.com/errata/RHSA-2026:63355' - url: 'https://access.redhat.com/errata/RHSA-2026:66084' - url: 'https://access.redhat.com/errata/RHSA-2026:66523' - url: 'https://access.redhat.com/errata/RHSA-2026:67711' - url: 'https://access.redhat.com/errata/RHSA-2026:67714' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:68765' - url: 'https://access.redhat.com/errata/RHSA-2026:68748' - url: 'https://access.redhat.com/errata/RHSA-2026:68755' tags: - nvd - ghsa - npm - csaf - vex - red-hat ingestedAt: '2026-08-02T07:18:02.106Z' epss: 0.0036 epssPercentile: 0.29777 aliases: - GHSA-hcpx-6fm6-wx23 ecosystem: npm vendor: axios product: axios affected: - 'axios >= 0.31.1, < 0.33.0' - 'axios >= 1.15.1, < 1.18.0' patched: - axios 0.33.0 - axios 1.18.0 cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor --- ## Overview axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-67321) Affected packages: - `axios >= 0.31.1, < 0.33.0` - `axios >= 1.15.1, < 1.18.0` Patched in: - `axios 0.33.0` - `axios 1.18.0` Source: https://github.com/advisories/GHSA-hcpx-6fm6-wx23 ## Vendor advisories - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:47619** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47619) - **RHSA-2026:48241** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48241) - **RHSA-2026:48758** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48758) - **RHSA-2026:59566** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59566) - **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583) - **RHSA-2026:65514** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65514) - **RHSA-2026:63373** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63373) - **RHSA-2026:63355** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63355) - **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, OpenShift Pipelines, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67321.json) - **RHSA-2026:66084** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66084) - **RHSA-2026:66523** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66523) - **RHSA-2026:67711** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67711) - **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)