axios CVE-2026-67313

Exploitation requires ALL of the following: (1) the target application must call axios.formToJSON(formData), use the named formToJSON import, or send a FormData object via axios with a Content-Type header containing application/json - normal multipart FormData requests that do not request JSON serialization do NOT trigger the vulnerable path; (2) the FormData field names passed to this functionality must be attacker-controlled and not sanitized or length-bounded before reaching axios; (3) for process termination (the worst-case impact), the application must additionally fail to catch the resulting rejected Promise or synchronous throw. Merely having axios installed, performing ordinary HTTP requests, or using toFormData() (which has its own maxDepth guard) does not expose the vulnerability. The CVSS 4.0 AT:P qualifier formally codifies condition (1) as a deployment prerequisite beyond simple network reachability.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:L) scores 6.3, reflecting medium severity. The AT:P (Attack Target: Prerequisite) qualifier is the key risk-limiting signal: exploitation is not possible against a generic axios installation - the target application must specifically invoke the formToJSON code path with attacker-controlled field names. This substantially narrows the vulnerable population compared to a straightforward AV:N/AC:L DoS. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not in CISA KEV and no public exploit code has been identified. In the default axios request path the stack overflow is returned as a rejected Promise before any network I/O occurs, meaning applications with proper async error handling degrade to request failures rather than process crashes. The real-world risk is highest for server-side Node.js applications that (a) expose an endpoint accepting raw FormData field names from untrusted users and (b) pass those names through formToJSON or JSON-serialized FormData without exception handling. The low availability impact (VA:L) in the official vector is appropriate: full process termination requires the additional condition of missing error handling, which is not guaranteed.

An attacker submits an HTTP POST request to a Node.js server endpoint with a FormData field name such as x[0][0][0]... repeated several thousand times. The server application passes the received FormData through axios.formToJSON() or sends it via axios with an application/json Content-Type. During buildPath() recursion, V8 throws RangeError: Maximum call stack size exceeded; if the application does not catch the synchronous throw or the resulting rejected Promise, the Node.js process terminates, taking the service offline until it is restarted. No public exploit code has been identified at time of analysis, but the attack is straightforward to replicate from the advisory's technical description.