axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-67313 · CVE overview and exploitation status

EUVD-2026-51866

GHSA-fq2j-3j99-rx65

GHSA-42h9-826w-cgv3

cve-program · CVE-2026-67313

• https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson

euvd · EUVD-2026-51866

• https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson

nvd · CVE-2026-67313

• https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson

osv · GHSA-42h9-826w-cgv3

• https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
• https://nvd.nist.gov/vuln/detail/CVE-2026-67313
• https://nvd.nist.gov/vuln/detail/CVE-2026-68942
• https://github.com/axios/axios/pull/11000
• https://github.com/axios/axios/pull/11001
• https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
• https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
• https://github.com/axios/axios
• https://github.com/axios/axios/releases/tag/v0.33.0
• https://github.com/axios/axios/releases/tag/v1.18.0
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson

osv · GHSA-fq2j-3j99-rx65

• https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
• https://nvd.nist.gov/vuln/detail/CVE-2026-67313
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson

• axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested bracket… · Advisory content revised · 15 Nov 2026
• axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested bracket… · Advisory content revised · 9 Nov 2026
• axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested bracket… · Advisory content revised · 1 Nov 2026
• axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested bracket… · Advisory content revised · 30 Oct 2026