CVE-2026-67321

axios, a widely used JavaScript HTTP client distributed via npm, contains an incomplete depth-limit bypass in toFormData.js (CWE-674, uncontrolled recursion) in versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0. When an application passes attacker-controlled object keys, including top-level keys ending in '{}', and nested values into axios's form or parameter serialization, the depth limit is bypassed and recursive processing ends with JSON.stringify throwing a RangeError. The impact is availability only: a denial of service in the affected request path (CVSS 4.0 6.9, medium), with no confidentiality or integrity impact. Any Node.js or browser application on the affected axios versions that serializes untrusted, attacker-influenced input into forms or request parameters is exposed. There is one public advisory reference (GHSA-hcpx-6fm6-wx23), but the flaw is not in CISA KEV and EPSS is 0.4% (29th percentile), so no confirmed in-the-wild exploitation is known.

What to do: Upgrade axios to 0.33.0 or later on the 0.x series, or 1.18.0 or later on the 1.x series. Audit whether your application passes attacker-controlled nested objects or keys (including keys ending in '{}') into axios form or parameter serialization via toFormData.js; as an interim mitigation, flatten or depth-limit untrusted input before handing it to these serializers. No emergency patching is indicated given low EPSS and no KEV listing, but include this in routine dependency updates.