GHSA-3mcp-22mf-vrw3Medium· 7.5▾ SunlitDuplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken
▾ Sunlit zone — Low / medium · no exploitation signal
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-hcpx-6fm6-wx23. This link is maintained to preserve external references.
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
axios >= 1.15.1, < 1.18.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67321Medium· 7.5axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'
GHSA-hcpx-6fm6-wx23MediumAxios form serializer maxDepth bypass via {} metatoken
GHSA-42h9-826w-cgv3MediumAxios: Excessive recursion in formDataToJSON can cause denial of service
CVE-2026-42039High· 7.5Axios is a promise based HTTP client for the browser and Node.js
GHSA-f4gw-2p7v-4548MediumAxios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
GHSA-mmx7-hfxf-jppxMediumAxios: Prototype pollution gadgets can alter axios request construction