EUVD-2026-51866PublishedWithdrawn

axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-67313

Published

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Source published: 1 Aug 2026 12:22:16 UTC
Source modified: 3 Aug 2026 19:30:22 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

euvd · EUVD-2026-51866

Published

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Aug 1, 2026, 12:22:16 PM

dateUpdated: Aug 3, 2026, 7:30:22 PM

30 related source bulletins · separate from aliases

RHSA-2026:48758: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-27459 · CVE-2026-62995 · CVE-2026-67312 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73086

RHSA-2026:67711: Red Hat Security Advisory: RHACS 4.10.8 security and bug fix update

CVE-2026-33818 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-75838 · CVE-2026-82417 · CVE-2026-84375

RHSA-2026:74511: Red Hat Security Advisory: Red Hat Quay 3.17.5

CVE-2026-15792 · CVE-2026-16221 · CVE-2026-18255 · CVE-2026-33818 · CVE-2026-39820 · CVE-2026-39822 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-49825 · CVE-2026-54770 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69153 · CVE-2026-84292 · CVE-2026-84394

RHSA-2026:68754: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.

CVE-2026-4800 · CVE-2026-45623 · CVE-2026-45819 · CVE-2026-47219 · CVE-2026-48801 · CVE-2026-54272 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56745 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-59887 · CVE-2026-59899 · CVE-2026-67213 · CVE-2026-67312 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-71436 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73508 · CVE-2026-73566 · CVE-2026-73646 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-82562 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

RHSA-2026:90321: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

CVE-2023-54404 · CVE-2025-62718 · CVE-2026-8643 · CVE-2026-9496 · CVE-2026-12185 · CVE-2026-13697 · CVE-2026-14682 · CVE-2026-15076 · CVE-2026-16308 · CVE-2026-17106 · CVE-2026-18427 · CVE-2026-19203 · CVE-2026-19534 · CVE-2026-39820 · CVE-2026-41178 · CVE-2026-41707 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-45416 · CVE-2026-47884 · CVE-2026-47886 · CVE-2026-47888 · CVE-2026-47890 · CVE-2026-47892 · CVE-2026-50010 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-55851 · CVE-2026-56745 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-56852 · CVE-2026-56854 · CVE-2026-58062 · CVE-2026-59280 · CVE-2026-59282 · CVE-2026-59283 · CVE-2026-59296 · CVE-2026-59313 · CVE-2026-59323 · CVE-2026-59651 · CVE-2026-59887 · CVE-2026-59899 · CVE-2026-59901 · CVE-2026-62243 · CVE-2026-64607 · CVE-2026-67213 · CVE-2026-67312 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-68494 · CVE-2026-68497 · CVE-2026-69152 · CVE-2026-69192 · CVE-2026-71290 · CVE-2026-71324 · CVE-2026-71325 · CVE-2026-71327 · CVE-2026-73500 · CVE-2026-73508 · CVE-2026-74835 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-76169 · CVE-2026-81521 · CVE-2026-82417 · CVE-2026-82562 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394 · CVE-2026-84428 · CVE-2026-84445 · CVE-2026-84469 · CVE-2026-84504 · CVE-2026-84961 · CVE-2026-85062 · CVE-2026-85124 · CVE-2026-85152 · CVE-2026-85595 · CVE-2026-85597 · CVE-2026-86063 · CVE-2026-87743 · CVE-2026-88004 · CVE-2026-88007 · CVE-2026-88008 · CVE-2026-88009 · CVE-2026-88011 · CVE-2026-88012 · CVE-2026-88031 · CVE-2026-88878 · CVE-2026-88879 · CVE-2026-90711 · CVE-2026-93749 · CVE-2026-100655 · CVE-2026-100656 · CVE-2026-100666 · CVE-2026-101916 · CVE-2026-102925 · CVE-2026-102930 · CVE-2026-103435 · CVE-2026-109618 · CVE-2026-109619

RHSA-2026:66084: Red Hat Security Advisory: Red Hat Quay 3.10.26

CVE-2026-15792 · CVE-2026-18255 · CVE-2026-32283 · CVE-2026-33818 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-84375

RHSA-2026:59566: Red Hat Security Advisory: Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3

CVE-2026-14257 · CVE-2026-45149 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089

WID-SEC-W-2026-2958: IBM License Metric Tool: Mehrere Schwachstellen

CVE-2026-10842 · CVE-2026-12185 · CVE-2026-12802 · CVE-2026-12803 · CVE-2026-12816 · CVE-2026-12860 · CVE-2026-13506 · CVE-2026-13586 · CVE-2026-14682 · CVE-2026-14981 · CVE-2026-15055 · CVE-2026-15064 · CVE-2026-15325 · CVE-2026-15328 · CVE-2026-16243 · CVE-2026-16439 · CVE-2026-16441 · CVE-2026-41254 · CVE-2026-46917 · CVE-2026-46968 · CVE-2026-47010 · CVE-2026-47021 · CVE-2026-47027 · CVE-2026-47057 · CVE-2026-47058 · CVE-2026-47059 · CVE-2026-47063 · CVE-2026-58059 · CVE-2026-58060 · CVE-2026-58061 · CVE-2026-58062 · CVE-2026-58063 · CVE-2026-59639 · CVE-2026-59642 · CVE-2026-59645 · CVE-2026-59647 · CVE-2026-59648 · CVE-2026-59650 · CVE-2026-59651 · CVE-2026-59652 · CVE-2026-60147 · CVE-2026-66066 · CVE-2026-67312 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67315 · CVE-2026-67316 · CVE-2026-67317 · CVE-2026-67318 · CVE-2026-67319 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-8400 · CVE-2026-8763

RHSA-2026:59561: Red Hat Security Advisory: Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1

CVE-2026-14257 · CVE-2026-45149 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-67313 · CVE-2026-67320 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:67714: Red Hat Security Advisory: RHACS 4.11.4 security and bug fix update

CVE-2026-33818 · CVE-2026-46600 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-56864 · CVE-2026-56865 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-75838 · CVE-2026-82417 · CVE-2026-84375

openSUSE-SU-2026:11680-1: agama-web-ui-24+0.a836cced5-52.1 on GA media

CVE-2025-7783 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-33245 · CVE-2026-49356 · CVE-2026-53550 · CVE-2026-53632 · CVE-2026-54466 · CVE-2026-55602 · CVE-2026-67313 · CVE-2026-67315 · CVE-2026-67317 · CVE-2026-67319 · CVE-2026-67321 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73650

RHSA-2026:65118: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update

CVE-2026-5079 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73563 · CVE-2026-73566 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-84292 · CVE-2026-84394

RHSA-2026:63307: Red Hat Security Advisory: Red Hat Quay 3.15.8

CVE-2026-15927 · CVE-2026-18255 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-56852 · CVE-2026-57231 · CVE-2026-59869 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:50826: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67315 · CVE-2026-67316 · CVE-2026-67317 · CVE-2026-67318 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-69198

RHSA-2026:59548: Red Hat Security Advisory: Kiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0

CVE-2026-14257 · CVE-2026-45149 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-67313 · CVE-2026-67320 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:69255: Red Hat Security Advisory: Red Hat Quay 3.16.6

CVE-2026-13149 · CVE-2026-15792 · CVE-2026-15927 · CVE-2026-16221 · CVE-2026-18255 · CVE-2026-32283 · CVE-2026-33818 · CVE-2026-39822 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-54058 · CVE-2026-54060 · CVE-2026-54770 · CVE-2026-55379 · CVE-2026-55380 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-57231 · CVE-2026-59197 · CVE-2026-59199 · CVE-2026-59200 · CVE-2026-59204 · CVE-2026-59205 · CVE-2026-59869 · CVE-2026-59879 · CVE-2026-59885 · CVE-2026-59886 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-73086 · CVE-2026-75593 · CVE-2026-82417 · CVE-2026-84375

RHSA-2026:81110: Red Hat Security Advisory: Red Hat Quay 3.18.1

CVE-2026-15792 · CVE-2026-16221 · CVE-2026-18255 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-49825 · CVE-2026-54058 · CVE-2026-54770 · CVE-2026-55379 · CVE-2026-55380 · CVE-2026-59197 · CVE-2026-59199 · CVE-2026-59200 · CVE-2026-59204 · CVE-2026-59205 · CVE-2026-59886 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321

RHSA-2026:63373: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

CVE-2026-12143 · CVE-2026-45623 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:63355: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

CVE-2026-12143 · CVE-2026-45623 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:68755: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

CVE-2026-12143 · CVE-2026-45623 · CVE-2026-45819 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73646 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172

RHSA-2026:68748: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

CVE-2026-12143 · CVE-2026-59869 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73646 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

RHSA-2026:66523: Red Hat Security Advisory: Red Hat Quay 3.12.22

RHSA-2026:68681: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update

CVE-2026-14257 · CVE-2026-16221 · CVE-2026-27145 · CVE-2026-33186 · CVE-2026-33818 · CVE-2026-42504 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-59869 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73566 · CVE-2026-73643 · CVE-2026-73646 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-76844 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84375 · CVE-2026-84394

RHSA-2026:65126: Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI

CVE-2025-61729 · CVE-2025-67030 · CVE-2026-4926 · CVE-2026-6734 · CVE-2026-9563 · CVE-2026-9697 · CVE-2026-12151 · CVE-2026-12243 · CVE-2026-13149 · CVE-2026-15075 · CVE-2026-15154 · CVE-2026-15378 · CVE-2026-15581 · CVE-2026-16745 · CVE-2026-18608 · CVE-2026-18611 · CVE-2026-18617 · CVE-2026-18620 · CVE-2026-18621 · CVE-2026-25681 · CVE-2026-26996 · CVE-2026-27136 · CVE-2026-27904 · CVE-2026-30922 · CVE-2026-32283 · CVE-2026-33231 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-33870 · CVE-2026-33871 · CVE-2026-34445 · CVE-2026-35536 · CVE-2026-39821 · CVE-2026-39829 · CVE-2026-39835 · CVE-2026-40171 · CVE-2026-40192 · CVE-2026-40895 · CVE-2026-41178 · CVE-2026-42027 · CVE-2026-42215 · CVE-2026-42284 · CVE-2026-42338 · CVE-2026-42502 · CVE-2026-42508 · CVE-2026-42578 · CVE-2026-42579 · CVE-2026-42581 · CVE-2026-42583 · CVE-2026-42584 · CVE-2026-42587 · CVE-2026-44240 · CVE-2026-44244 · CVE-2026-44249 · CVE-2026-44431 · CVE-2026-44893 · CVE-2026-45112 · CVE-2026-45416 · CVE-2026-45623 · CVE-2026-45674 · CVE-2026-45736 · CVE-2026-45819 · CVE-2026-47691 · CVE-2026-48043 · CVE-2026-48059 · CVE-2026-48586 · CVE-2026-48779 · CVE-2026-49978 · CVE-2026-50010 · CVE-2026-50193 · CVE-2026-53550 · CVE-2026-54293 · CVE-2026-54512 · CVE-2026-55685 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-55851 · CVE-2026-56745 · CVE-2026-56746 · CVE-2026-56819 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-59869 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-59885 · CVE-2026-59899 · CVE-2026-66036 · CVE-2026-66039 · CVE-2026-67313 · CVE-2026-67320 · CVE-2026-67322 · CVE-2026-67323 · CVE-2026-67324 · CVE-2026-67325 · CVE-2026-68494 · CVE-2026-69112 · CVE-2026-69152 · CVE-2026-69192 · CVE-2026-69243 · CVE-2026-69244 · CVE-2026-71281 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73415 · CVE-2026-73417 · CVE-2026-73566 · CVE-2026-73622 · CVE-2026-73623 · CVE-2026-73624 · CVE-2026-73625 · CVE-2026-73627 · CVE-2026-73643

RHSA-2026:70267: Red Hat Security Advisory: Red Hat Quay 3.14.9

CVE-2026-4427 · CVE-2026-6322 · CVE-2026-9277 · CVE-2026-10143 · CVE-2026-12143 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-14257 · CVE-2026-15792 · CVE-2026-15927 · CVE-2026-16221 · CVE-2026-18255 · CVE-2026-32591 · CVE-2026-33747 · CVE-2026-33748 · CVE-2026-33818 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39822 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42499 · CVE-2026-42504 · CVE-2026-42508 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-44705 · CVE-2026-44990 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-48526 · CVE-2026-49477 · CVE-2026-54058 · CVE-2026-54060 · CVE-2026-55379 · CVE-2026-55380 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-57231 · CVE-2026-59197 · CVE-2026-59199 · CVE-2026-59200 · CVE-2026-59204 · CVE-2026-59205 · CVE-2026-59869 · CVE-2026-59885 · CVE-2026-59886 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-84375

RHSA-2026:59554: Red Hat Security Advisory: Kiali 2.17.13 for Red Hat OpenShift Service Mesh 3.2

CVE-2026-14257 · CVE-2026-45149 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-67313 · CVE-2026-67320 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:65514: Red Hat Security Advisory: Red Hat Quay 3.9.26

CVE-2026-15792 · CVE-2026-16221 · CVE-2026-18255 · CVE-2026-32283 · CVE-2026-33818 · CVE-2026-44705 · CVE-2026-49477 · CVE-2026-56852 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-67213 · CVE-2026-67214 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:68765: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

CVE-2026-12143 · CVE-2026-45819 · CVE-2026-59879 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73646 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172

RHSA-2026:59583: Red Hat Security Advisory: Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4

CVE-2026-14257 · CVE-2026-41178 · CVE-2026-45623 · CVE-2026-54272 · CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192 · CVE-2026-73088 · CVE-2026-73089

RHSA-2026:49714: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-67313 · CVE-2026-67314 · CVE-2026-67315 · CVE-2026-67316 · CVE-2026-67317 · CVE-2026-67318

Source published: Aug 1, 2026, 12:22:16 PM (timezone not stated)
Source modified: Aug 3, 2026, 7:30:22 PM (timezone not stated)
Saved here: 15 Nov 2026 16:52:45 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

nvd · CVE-2026-67313

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-400

Original publisher date fields

published: 2026-08-01T13:17:01.283

lastModified: 2026-09-01T15:40:52.167

1 source CPE criteria · context only

cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 1 Aug 2026 13:17:01 UTC
Source modified: 1 Sep 2026 15:40:52 UTC
Saved here: 25 Oct 2026 15:18:51 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-42h9-826w-cgv3

Published

## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type. Applications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: Maximum call stack size exceeded`, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination. ## Impact The impact is denial of service against applications that process untrusted `FormData` field names through axios' FormData-to-JSON conversion. The vulnerable path is not reached by merely installing axios, by normal multipart `FormData` pass-through, or by ordinary axios requests that do not request JSON serialisation of `FormData`. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of `formToJSON()` throws synchronously. Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with `formToJSON()` or sends them through axios as JSON. ## Affected Functionality Affected APIs and paths: - `axios.formToJSON(formData)` - `import { formToJSON } from "axios"` - `lib/helpers/formDataToJSON.js` - axios default `transformRequest` when `data` is `FormData` and `Content-Type` contains `application/json` Unaffected or lower-risk paths: - Normal multipart `FormData` requests without `JSON Content-Type` - `toFormData()` object-to-FormData serialisation, which already has a `maxDepth` guard - Axios versions before 0.28.0, where this helper and public API were not present ## Technical Details `lib/helpers/formDataToJSON.js` parses a form field name into path segments with `parsePropPath()`. For a key such as `a[x][x][x]`, each bracketed segment becomes another path element. `formDataToJSON()` then calls the nested `buildPath(path, value, target, index)` function. `buildPath()` recursively calls itself once for each path segment and does not enforce a maximum depth: `const result = buildPath(path, value, target[name], index);` A key containing thousands of bracket segments, therefore, creates thousands of recursive calls. At sufficient depth, V8 throws `RangeError: Maximum call stack size exceeded`. Axios already applies a depth guard to the inverse serializer in `lib/helpers/toFormData.js`, where `maxDepth` defaults to 100 and exceeding it throws `AxiosError` with code `ERR_FORM_DATA_DEPTH_EXCEEDED`. `formDataToJSON()` does not currently have equivalent protection. ## Proof of Concept of Attack ```js import { formToJSON } from "axios"; const fd = new FormData(); fd.append("a" + "[x]".repeat(15000), "value"); try { formToJSON(fd); console.log("not vulnerable"); } catch (err) { console.log(`${err.constructor.name}: ${err.message}`); } ``` Expected vulnerable result: RangeError: Maximum call stack size exceeded The axios request transform path can also be reached before network I/O: ```js import axios from "axios"; const fd = new FormData(); fd.append("a" + "[x]".repeat(15000), "value"); await axios .post("http://127.0.0.1:1/", fd, { headers: { "Content-Type": "application/json" } }) .catch((err) => console.log(`${err.constructor.name}: ${err.message}`)); ``` Expected vulnerable result: RangeError: Maximum call stack size exceeded ## Workarounds Applications can avoid the vulnerable path by not converting attacker-controlled `FormData` to JSON with axios. If conversion is required before a fixed axios release is available, validate `FormData` field names before calling `formToJSON()` or before sending `FormData` with `Content-Type: application/json`. Reject keys whose parsed nesting depth exceeds the application's expected schema. For axios requests carrying untrusted `FormData`, avoid setting `Content-Type: application/json`; leaving the data as multipart FormData bypasses `formDataToJSON()`. Catching the resulting error can prevent process termination, but it does not remove the uncontrolled-recursion behaviour and should not be treated as the primary mitigation. <details> <summary>Original Report</summary> # Axios SSRF via Incomplete Loopback Detection ## CWE-918 | CVSS 7.5 (HIGH) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L --- ## 1. Classification | CWE | CVSS Score | Severity | Type | |-----|-----------|----------|------| | CWE-918 | 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) | HIGH | Server-Side Request Forgery | ## 2. Description ### Summary The `shouldBypassProxy()` function in Axios fails to recognise `0.0.0.0`, `::`, and `::ffff:0.0.0.0` as loopback addresses. When `NO_PROXY=localhost` is configured, requests to these addresses are incorrectly forwarded through the proxy instead of being sent directly, enabling an SSRF attack against internal services reachable via the proxy's loopback interface. ### Root Cause **File:** `lib/helpers/shouldBypassProxy.js` **`isIPv4Loopback` (lines 3-8):** Only checks for `127.x.x.x` addresses by inspecting `parts[0] !== '127'`. The `0.0.0.0` address has `parts[0] === '0'`, so it falls through as non-loopback, even though on Linux `0.0.0.0` routes to the loopback interface. **`isIPv6Loopback` (lines 10-38):** Only checks `host === '::1'`. The `::` address (unspecified IPv6) also routes to the loopback, but is not recognised. **Attack Flow:** ``` isIPv4Loopback (line 3) — fails for 0.0.0.0 → isLoopback (line 44) — wraps both checks, returns false → shouldBypassProxy (line 127) — PUBLIC API, exported default → lib/adapters/http.js (line 190) — Node.js HTTP adapter ``` ### Attack Vector - **Access Vector:** Network (AV:N) - **Access Complexity:** Low (AC:L) — attacker only needs control of a URL - **Privileges Required:** None (PR:N) - **User Interaction:** None (UI:N) ## 3. Proof of Concept ### Phase 1: Logic Verification ```javascript import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js'; // Normal loopback — correctly returns true (bypasses proxy) shouldBypassProxy('http://127.0.0.1:9999/'); // → true // Vulnerable — returns false (goes through proxy!) shouldBypassProxy('http://0.0.0.0:9999/'); // → false ← SSRF shouldBypassProxy('http://[::]:9999/'); // → false ← SSRF shouldBypassProxy('http://[::ffff:0.0.0.0]:9999/'); // → false ← SSRF ``` ### Phase 2: Docker E2E Reproduction A full 3-container Docker reproduction was created and tested: - **Proxy container:** Simple HTTP forward proxy on port 8888 - **Internal container:** Internal service on port 9999 (simulates sensitive internal resource) - **Attacker container:** Runs the test script with Axios source mounted **Reproduction steps:** ```bash cd /tmp/deep-e2e docker compose up -d docker compose exec attacker node test-ssrf.js ``` **Results:** - Test 1: `127.0.0.1 + NO_PROXY=localhost` → BYPASS (correct) - Test 2: `0.0.0.0 + NO_PROXY=localhost` → VIA_PROXY (SSRF) - Test 3: `[::] + NO_PROXY=localhost` → VIA_PROXY (SSRF) - Test 4: `[::ffff:0.0.0.0] + NO_PROXY=localhost` → VIA_PROXY (SSRF) ### Phase 3: Actual Axios Client The real Axios HTTP client (v1.16.1, source tree) was tested through proxy configuration: - Axios with `proxy: { host: 'proxy', port: 8888 }` - Setting `NO_PROXY=localhost` and requesting `http://0.0.0.0:9999/` - Result: Axios forwarded the request through the proxy instead of bypassing it ## 4. Impact ### Attack Scenario 1. Attacker has control over a URL that an Axios client will request (direct input, redirect target, open redirect chain) 2. The Axios client is configured with a proxy (e.g., corporate proxy) and `NO_PROXY=localhost` to protect internal services 3. Attacker supplies `http://0.0.0.0:8080/admin` as the target URL 4. Axios sends the request through the proxy 5. The proxy resolves `0.0.0.0` → the proxy's own loopback → reaches the internal admin service on port 8080 ### Potential Consequences - **Information disclosure (C:L):** Internal service responses become accessible - **Integrity impact (I:L):** Attacker can trigger actions on internal services (if proxy supports PUT/POST/DELETE) - **Availability impact (A:L):** Limited — depends on internal service behavior ### Likelihood - **High** — proxy bypass is a common pattern in microservice architectures - **Medium** — requires attacker control of a URL (not always available) ## 5. Remediation ### Code Fix **File:** `lib/helpers/shouldBypassProxy.js` ```javascript function isIPv4Loopback(host) { if (host === '0.0.0.0') return true; // ADD THIS LINE const parts = host.split('.'); if (parts.length !== 4) return false; if (parts[0] !== '127') return false; return parts.every(p => /^\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255); } function isIPv6Loopback(host) { if (host === '::1' || host === '::') return true; // ADD '::' // ... rest of implementation } ``` ### Workarounds - Add `0.0.0.0` and `::` to the `NO_PROXY` environment variable explicitly - Use `127.0.0.1` instead of `0.0.0.0` in all internal service URLs - Implement URL validation to reject `0.0.0.0` and `::` before passing to Axios

Source published: 20 Jul 2026 17:58:59 UTC
Source modified: 10 Sep 2026 03:51:10 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Publisher rating · MODERATE

osv · GHSA-fq2j-3j99-rx65

Withdrawn

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42h9-826w-cgv3. This link is maintained to preserve external references. ## Original Description axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Source published: 1 Aug 2026 15:30:27 UTC
Source modified: 10 Sep 2026 03:50:53 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · MODERATE