CVE-2026-67313: Axios DoS Vulnerability via Recursion

CVE-2026-67313 Overview

CVE-2026-67313 is a denial-of-service vulnerability affecting axios versions 0.28.0 and later. The flaw resides in the formDataToJSON helper, which recursively parses FormData field names containing bracket segments. An attacker can submit FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack. The result is a RangeError: Maximum call stack size exceeded exception, which terminates the request or crashes the Node.js process when the exception is unhandled. The weakness is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Remote unauthenticated attackers can trigger process termination or request failure in Node.js applications that parse attacker-controlled FormData through axios.

Affected Products

axios version 0.28.0 and later releases prior to the patched version
Node.js server-side applications using axios to parse FormData input
Downstream libraries and frameworks that embed the vulnerable axios versions

Discovery Timeline

2026-08-01 - CVE-2026-67313 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67313

Vulnerability Analysis

The formDataToJSON helper in axios converts FormData entries into structured JSON objects. Field names such as user[address][city] are split on bracket segments and processed through a recursive function that descends into each nested key. The recursion depth grows linearly with the number of bracket segments in the field name.

The implementation does not enforce a maximum recursion depth or an upper bound on the number of segments per key. An attacker supplies a single field name containing thousands of nested brackets, such as a[0][0][0]...[0]. Each segment produces another recursive call until the V8 engine exhausts its default call stack.

When the stack is exhausted, Node.js throws RangeError: Maximum call stack size exceeded. Applications that do not wrap the parsing operation in a try/catch propagate the exception and can crash the process. See the GitHub Security Advisory and VulnCheck Advisory for technical details.

Root Cause

The root cause is the absence of a depth limit in the recursive parser inside formDataToJSON. User-controlled input directly determines the recursion depth, allowing attackers to select a value that exceeds the V8 stack limit.

Attack Vector

Exploitation requires an application that passes attacker-supplied FormData to axios for JSON conversion. The attacker sends a crafted multipart/form-data request containing a field whose name embeds a large number of nested bracket segments. No authentication is required when the target endpoint accepts anonymous form submissions.

Detection Methods for CVE-2026-67313

Indicators of Compromise

HTTP request bodies containing multipart/form-data field names with abnormally long bracket-segment chains, for example more than 100 consecutive [...] groups.
Node.js process logs recording RangeError: Maximum call stack size exceeded traced to formDataToJSON.
Unexpected process restarts or worker crashes coinciding with inbound FormData requests.

Detection Strategies

Inspect application dependencies for axios versions >= 0.28.0 using npm ls axios or the equivalent lockfile audit.
Add web application firewall rules that reject FormData field names exceeding a reasonable bracket depth or total length.
Correlate RangeError exceptions in application telemetry with the originating HTTP request identifier and source address.

Monitoring Recommendations

Monitor Node.js process crash counters and restart events for services that accept multipart uploads.
Alert on repeated 5xx responses or connection resets from endpoints that invoke axios FormData parsing.
Track outbound network calls that carry unusually large field-name payloads to identify propagation to downstream services.

How to Mitigate CVE-2026-67313

Immediate Actions Required

Upgrade axios to the patched release identified in the GitHub Security Advisory GHSA-42h9-826w-cgv3.
Wrap any call path that invokes formDataToJSON in a try/catch block to prevent uncaught RangeError from terminating the process.
Reject inbound FormData requests whose field names exceed a bounded length or bracket depth at the reverse proxy or API gateway.

Patch Information

The axios maintainers released a fixed version that enforces a maximum recursion depth in formDataToJSON. Consult the GitHub Security Advisory for the exact patched version numbers and the corresponding commit references.

Workarounds

Pin axios to a version prior to 0.28.0 if an immediate upgrade is not feasible and application compatibility allows.
Preprocess incoming FormData to strip or reject field names containing more than a small, fixed number of bracket segments.
Route multipart traffic through a validation middleware that enforces field-name length limits before axios processes the payload.

bash

# Configuration example
npm install axios@latest
npm ls axios