CVE-2026-67312 Overview
CVE-2026-67312 is a denial-of-service vulnerability in the axios HTTP client library for JavaScript. The flaw affects axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0. The vulnerability resides in the formDataToJSON function, exposed publicly as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json. Attacker-controlled FormData field names containing thousands of nested bracket-delimited segments trigger unbounded recursion in buildPath(), exhausting the JavaScript call stack.
Critical Impact
Attackers can trigger a RangeError: Maximum call stack size exceeded remotely without authentication, causing request failure or full process termination in applications lacking error handling.
Affected Products
- axios versions 0.28.0 through 0.32.x
- axios versions 1.0.0 through 1.17.x
- Node.js and browser applications passing untrusted FormData field names to axios serialization
Discovery Timeline
- 2026-08-01 - CVE-2026-67312 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67312
Vulnerability Analysis
The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. The axios library provides formToJSON() as a utility that converts FormData objects into JSON structures. Field names using bracket notation such as a[b][c][d] are parsed into nested JSON objects. The parsing routine relies on buildPath(), a recursive function that descends one level per bracket segment.
The implementation does not enforce a maximum recursion depth or an upper bound on segment count. An attacker who controls FormData field names can submit a single field whose key contains thousands of bracket-delimited segments. Each segment produces one recursive call, and the V8 JavaScript engine terminates execution once the call stack ceiling is reached.
Root Cause
The root cause is missing input validation on FormData field name depth in formDataToJSON. The recursive buildPath() helper trusts the parsed segment array length and does not check it against a safe threshold. JavaScript engines have relatively shallow default call stacks, so exhaustion occurs quickly with attacker-controlled input.
Attack Vector
The attack requires no authentication and no user interaction. Any application that forwards untrusted FormData through axios.formToJSON(), or transmits FormData with Content-Type: application/json, is a viable target. An attacker submits a multipart form or FormData object containing a field name such as a[0][0][0]...[0] repeated thousands of times. When axios serializes the payload, buildPath() recurses until the stack overflows, throwing an uncaught RangeError that terminates the request handler or the entire Node.js process. Refer to the GitHub Security Advisory for reproduction details.
Detection Methods for CVE-2026-67312
Indicators of Compromise
- Application logs containing RangeError: Maximum call stack size exceeded originating from axios helpers/formDataToJSON.js or buildPath
- Unexpected Node.js process crashes or worker restarts correlated with inbound HTTP requests carrying FormData payloads
- Inbound requests with FormData field names exceeding typical bracket-nesting depth (for example, more than 100 [ characters)
Detection Strategies
- Inspect HTTP request bodies at the reverse proxy or WAF for FormData keys with excessive bracket segments and reject them before they reach application code
- Enable structured logging of unhandled promise rejections and uncaught exceptions to surface stack-exhaustion events
- Track the installed axios version across services using SBOM tooling and flag any version in the vulnerable ranges
Monitoring Recommendations
- Alert on repeated RangeError exceptions in Node.js application logs within short time windows
- Monitor process restart rates and container OOM or crash events for services exposing multipart or FormData endpoints
- Baseline typical FormData field name lengths and generate alerts when inbound requests exceed the baseline by orders of magnitude
How to Mitigate CVE-2026-67312
Immediate Actions Required
- Upgrade axios to version 0.33.0 or later on the 0.x branch, or to 1.18.0 or later on the 1.x branch
- Audit application code for calls to axios.formToJSON() and any code path that forwards attacker-controlled FormData through axios with Content-Type: application/json
- Add global handlers for uncaughtException and unhandledRejection in Node.js services to prevent full process termination
Patch Information
The axios maintainers addressed the vulnerability in versions 0.33.0 and 1.18.0 by bounding recursion depth in buildPath(). See the GitHub Security Advisory GHSA-pmv8-rq9r-6j72 and the VulnCheck Advisory for fix details.
Workarounds
- Validate and reject FormData field names whose bracket-segment count exceeds a safe threshold before invoking axios
- Avoid passing untrusted FormData objects directly to axios.formToJSON() or to axios requests configured with Content-Type: application/json
- Enforce request size and field-name length limits at the WAF or API gateway to block pathological payloads
# Upgrade axios to a patched version
npm install axios@^1.18.0
# Or, for projects pinned to the 0.x branch
npm install axios@^0.33.0
# Verify the installed version
npm ls axios
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
