CVE-2026-67313

Axios versions 0.28.0 and later contain an uncontrolled recursion flaw (CWE-400) in the formDataToJSON helper, which converts FormData field names into nested JSON objects by interpreting bracket notation (e.g., key[subkey][subkey]). An attacker who can influence the field names of FormData passed to axios - for example, an application that forwards user-supplied multipart form data - can supply keys with thousands of nested bracket segments, exhausting the JavaScript call stack and raising a RangeError. The immediate result is a failed HTTP request; in applications that do not catch the exception, the process can terminate, yielding a remote denial-of-service (CVSS 4.0 scores this as low availability impact with no confidentiality or integrity impact). Any application or service using axios 0.28.0 or later to process attacker-influenced FormData is affected, particularly Node.js backends that relay client-supplied form fields. As of this writing a public advisory with PoC reference exists (GHSA-42h9-826w-cgv3), EPSS is low at 0.4% (36th percentile), the flaw is not in CISA KEV, and no confirmed in-the-wild exploitation has been reported.

What to do: Upgrade axios to the patched release referenced in the vendor advisory GHSA-42h9-826w-cgv3 (check the advisory/release notes for the fixed version). As interim mitigations, validate or cap the bracket-nesting depth of FormData field names received from untrusted sources, wrap axios calls in exception handling so a RangeError cannot terminate the process, or serialize form data yourself (e.g., via URLSearchParams or plain objects) instead of relying on automatic FormData-to-JSON conversion. Audit Node.js backends and bundled front-end code for axios usage where external input controls multipart/form-data keys.