Skip to main content

axios EUVDEUVD-2026-51866

| CVE-2026-67313 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-08-01 VulnCheck GHSA-fq2j-3j99-rx65
Denial Of Service Axios
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H reflects the AT:P prerequisite (application must use formToJSON with attacker-controlled input); no confidentiality or integrity impact; availability is low, not high, because process termination requires additional absent exception handling.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:39 vuln.today
Analysis Generated
Aug 01, 2026 - 13:39 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 39 npm packages depend on axios (18 direct, 21 indirect)

Ecosystem-wide dependent count for version 0.28.0.

DescriptionCVE.org

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

AnalysisAI

Uncontrolled recursion in axios's formDataToJSON helper (versions 0.28.0 through <0.33.0 and 1.0.0 through <1.18.0) allows unauthenticated remote attackers to exhaust the JavaScript call stack by submitting FormData with field names containing thousands of nested bracket segments. The vulnerable buildPath() function in lib/helpers/formDataToJSON.js recurses once per path segment with no depth limit, causing a RangeError that, in server-side Node.js applications lacking exception handling, can terminate the process. No active exploitation or public exploit code has been identified at time of analysis; two patched releases (0.33.0 and 1.18.0) are available.

Technical ContextAI

axios is a Promise-based HTTP client for Node.js and browsers (CPE: cpe:2.3:a:axios:axios), and one of the most widely downloaded npm packages. The vulnerability exists in lib/helpers/formDataToJSON.js, introduced in version 0.28.0 when the formToJSON public API was added. The parsePropPath() function tokenizes a FormData field name such as a[x][x][x] into discrete path segments; the recursive buildPath() function then processes each segment by calling itself without enforcing a maximum call depth. CWE-400 (Uncontrolled Resource Consumption) describes the root cause precisely: an attacker-controlled input directly sizes the recursion depth, consuming call stack memory proportional to the number of bracket segments supplied. Critically, the sibling toFormData() function already enforces a maxDepth guard - the oversight was omitted only from buildPath(). The vulnerable code path is reached via axios.formToJSON(formData), the named formToJSON export, or the default transformRequest when FormData is sent with an application/json Content-Type header.

RemediationAI

Upgrade to axios 0.33.0 (for users on the 0.x branch) or axios 1.18.0 (for users on the 1.x branch), both of which introduce a maximum recursion depth guard in buildPath() consistent with the guard already present in toFormData(). The upstream fixes are tracked in GitHub pull requests #11000 and #11001 (https://github.com/axios/axios/pull/11000, https://github.com/axios/axios/pull/11001). The vendor advisory is at https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3. If an immediate upgrade is not feasible, a targeted workaround is to avoid sending FormData with an application/json Content-Type header through axios and to avoid calling axios.formToJSON() or the named formToJSON export on untrusted input - switching to standard multipart FormData submission (without JSON serialization) entirely bypasses the vulnerable code path with no functional loss for most use cases. As an additional defensive layer regardless of patch status, ensure all axios calls are wrapped in try/catch or .catch() handlers to prevent uncaught RangeErrors from terminating the Node.js process; this limits the worst-case impact to individual request failures rather than service outage.

More in Axios

View all
CVE-2026-42043 CRITICAL POC
10.0 Apr 24

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42039 MEDIUM POC
6.9 Apr 24

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
CVE-2026-42041 MEDIUM POC
6.5 Apr 24

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

EUVD-2026-51866 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy