---
id: GHSA-3mcp-22mf-vrw3
title: 'Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken'
summary: 'Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken'
severity: medium
cvss: 7.5
cwe:
  - CWE-674
vendor: axios
product: axios
ecosystem: npm
affected:
  - 'axios >= 1.15.1, < 1.18.0'
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T17:16:46Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3mcp-22mf-vrw3'
references:
  - url: 'https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67321'
  - url: >-
      https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass
  - url: 'https://github.com/advisories/GHSA-3mcp-22mf-vrw3'
tags:
  - ghsa
  - npm
ingestedAt: '2026-09-08T18:07:34.882Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hcpx-6fm6-wx23. This link is maintained to preserve external references.

## Original Description
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

## Affected packages

- `axios >= 1.15.1, < 1.18.0`

## Remediation

Refer to the advisory for the patched release.