CVE-2026-67313 in axios
Summary
by MITRE • 08/01/2026
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability affects axios versions 0.28.0 and later, where the formDataToJSON function contains a recursive implementation that becomes susceptible to uncontrolled recursion when processing FormData field names with deeply nested bracket segments. The flaw stems from the function's inability to properly validate or limit the depth of nested brackets in field names, creating a path for malicious input to trigger excessive stack consumption. When an attacker crafts FormData with field names containing thousands of nested brackets such as name[0][0][0]...[0], the recursive parsing mechanism exhausts the JavaScript call stack and raises a RangeError exception. This represents a classic stack overflow vulnerability that can be exploited to cause denial of service conditions in applications relying on axios for HTTP requests.
The technical implementation of this vulnerability demonstrates a lack of input validation and recursion depth limiting within the formDataToJSON function. The recursive parsing algorithm processes each bracket segment sequentially without maintaining a maximum recursion depth threshold, allowing attackers to craft malicious payloads that exponentially increase the call stack usage. This behavior aligns with CWE-674, which describes "Uncontrolled Recursion" as a weakness where recursive functions lack proper termination conditions or depth limits. The vulnerability is particularly concerning because it can be triggered through normal HTTP request processing when applications accept user-provided FormData inputs without sanitization.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, potentially affecting application availability and stability in production environments. When the RangeError occurs during request processing, it can cause complete request failure or even process termination if the exception is not properly handled by the consuming application. Applications using axios for form data handling become vulnerable to attacks that can be executed through any HTTP endpoint accepting FormData input, making this a widespread concern across web applications and APIs. The vulnerability affects both client-side and server-side implementations where axios is used for request processing, as demonstrated by the ATT&CK technique T1499.3, which covers "Uncontrolled Full-Stack Resource Consumption" targeting application-level denial of service conditions.
Mitigation strategies should focus on implementing input validation and recursion depth limiting within the axios library itself, while applications should validate and sanitize all user-provided FormData field names before processing. Developers should consider implementing custom formDataToJSON functions with proper recursion depth checks or upgrading to patched versions of axios once available. Additionally, defensive programming practices such as setting maximum recursion limits and implementing proper exception handling for RangeError conditions can help prevent exploitation. Organizations should also monitor their application logs for unusual patterns in request processing that might indicate exploitation attempts, and consider implementing rate limiting or input size restrictions on FormData submissions to reduce attack surface. The vulnerability highlights the importance of secure coding practices around recursive algorithms and proper input sanitization in web applications.