CVE-2026-67312

axios, a widely used JavaScript HTTP client library, contains an uncontrolled recursion flaw (CWE-400) in its formDataToJSON implementation, reachable through axios.formToJSON() and internally whenever a request serializes FormData with a JSON Content-Type. If an application passes attacker-controlled FormData field names, a name built from thousands of nested bracket-delimited segments drives the buildPath() helper into unbounded recursion, exhausting the JavaScript call stack with a 'RangeError: Maximum call stack size exceeded'. An attacker gains denial of service: the affected request fails, and in applications lacking appropriate error handling the whole Node.js or browser process can terminate, letting the attacker crash the service repeatedly (CVSS 4.0 scores this 6.3, medium, with availability-only impact). Anyone running axios 0.28.0 up to but not including 0.33.0, or 1.0.0 up to but not including 1.18.0, in code paths that convert untrusted FormData to JSON is affected. A public proof of concept exists via the upstream advisory (GHSA-pmv8-rq9r-6j72), but there is no confirmed in-the-wild exploitation so far: EPSS is 0.4% (36th percentile) and the issue is not on CISA KEV.

What to do: Upgrade axios to 1.18.0 or later, or at least 0.33.0 on the legacy 0.x branch. Until patched, validate or length-limit attacker-controlled FormData field names, avoid axios.formToJSON()/JSON-serialized FormData with untrusted field names, and wrap affected handling in try/catch so a RangeError cannot terminate the process. Audit dependency manifests and server logs for 'Maximum call stack size exceeded' errors to spot past exploitation attempts.