CVE-2026-67321 in axios
Summary
by MITRE • 08/01/2026
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in axios versions prior to 0.33.0 represents a critical security flaw in the form data serialization process that can lead to denial of service conditions. This issue specifically affects the toFormData.js module where objects with top-level keys ending in '{}' are processed in a manner that bypasses intended depth limitations. The vulnerability stems from an incomplete implementation of depth checking mechanisms that should prevent excessive recursion during object serialization. When malicious actors control both the object keys and their nested values, they can craft requests that exploit this weakness to trigger RangeError exceptions through JSON.stringify operations.
The technical execution of this vulnerability relies on the improper handling of object key patterns ending with curly braces, which creates a bypass in the depth-limiting logic. This flaw allows attackers to construct specially formatted objects where top-level keys terminate with '{}' characters, causing the serialization process to recurse beyond acceptable limits. The underlying issue manifests as a RangeError during JSON.stringify operations, which occurs because the depth validation mechanism fails to properly account for these specific key patterns. This bypass effectively neutralizes the intended protection against excessive object nesting and recursive data structures that could otherwise be controlled through standard depth limiting parameters.
From an operational impact perspective, this vulnerability creates significant risks for applications relying on axios for form data processing and HTTP request handling. The denial of service condition affects the entire request path where the vulnerable serialization occurs, potentially disrupting legitimate user requests and application functionality. Systems using axios for API communications, form submissions, or parameter processing become susceptible to attacks that can cause complete service unavailability. The vulnerability is particularly concerning because it requires minimal privileges to exploit - attackers only need control over object keys and their associated values rather than elevated system access. This makes the attack surface broad and accessible to various threat actors.
The security implications of this vulnerability align with CWE-770, which addresses allocation of resources without limits or with inadequate limits, and can be categorized under ATT&CK technique T1499 for network denial of service. Organizations should immediately implement mitigations including upgrading to axios version 0.33.0 or later where the depth-limit bypass has been corrected. Additionally, developers should consider implementing additional input validation layers when processing user-controlled data in form serialization contexts. The fix typically involves strengthening the depth checking logic to properly account for all key patterns and ensuring that JSON.stringify operations are protected against excessive recursion through more robust validation mechanisms. Organizations should also review their application code for similar patterns in custom serialization logic that might be susceptible to analogous issues.