CVE-2026-67321: Axios Depth-Limit Bypass DoS Vulnerability

CVE-2026-67321 Overview

CVE-2026-67321 is a denial-of-service vulnerability in the axios HTTP client library. The flaw resides in toFormData.js and stems from an incomplete depth-limit check applied when serializing objects with top-level keys ending in {}. Affected versions include axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0. An attacker who controls object keys and nested values passed into form or parameter serialization can force JSON.stringify to raise a RangeError, disrupting the request path. The issue is tracked under CWE-674: Uncontrolled Recursion.

Critical Impact
Applications using vulnerable axios releases can be forced into a denial-of-service condition on any code path that serializes attacker-influenced objects through toFormData.

Affected Products

axios 0.31.1 through versions before 0.33.0
axios 1.15.1 through versions before 1.18.0
Node.js and browser applications that pass user-controlled data to axios form or parameter serialization

Discovery Timeline

2026-08-01 - CVE-2026-67321 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67321

Vulnerability Analysis

The vulnerability lives in the toFormData.js helper responsible for converting JavaScript objects into FormData or serialized parameter representations before dispatching HTTP requests. axios maintains a maxDepth guard intended to prevent unbounded recursion when walking nested structures. The guard is bypassed when a top-level key ends with {}, causing the serializer to fall back to a direct JSON.stringify call on the associated value. When the nested value itself is deeply structured or cyclic in shape, JSON.stringify throws a RangeError: Maximum call stack size exceeded. The uncaught error interrupts the request pipeline and, in server-side deployments, can propagate up the async boundary and impact worker responsiveness.

Root Cause

The root cause is an incomplete input validation path in the depth-limiting logic. The parser branches on the suffix of the key name and skips the recursive walk that enforces maxDepth, delegating serialization to the JavaScript runtime without additional bounds checking. This categorizes the issue as uncontrolled recursion (CWE-674).

Attack Vector

Exploitation requires no authentication and no user interaction. Any application that forwards attacker-controlled JSON, query parameters, or form fields into axios request options—for example, a proxy layer, a webhook relay, or a server-side rendering call—can trigger the fault. The attacker crafts a payload whose top-level key ends with {} and whose associated value contains a structure that overflows the engine's call stack during JSON.stringify. See the GitHub Security Advisory GHSA-hcpx-6fm6-wx23 and the VulnCheck Advisory for full technical detail.

No verified proof-of-concept code has been published. Refer to the linked advisories for a technical walkthrough of the vulnerable code path.

Detection Methods for CVE-2026-67321

Indicators of Compromise

Application logs containing RangeError: Maximum call stack size exceeded originating from toFormData.js or axios/lib/helpers/toFormData.js
Repeated request failures on endpoints that accept nested JSON or form payloads from external callers
Unhandled promise rejections referencing JSON.stringify in axios request preparation frames

Detection Strategies

Inventory application dependencies using npm ls axios or SBOM tooling to identify vulnerable versions in the 0.31.1–0.32.x and 1.15.1–1.17.x ranges
Add structured error logging around axios call sites so RangeError events are captured with the offending key names
Inspect ingress payloads for top-level object keys ending in {} combined with deeply nested values, which is an unusual pattern in normal API traffic

Monitoring Recommendations

Track process crash rates, event-loop lag, and 5xx response spikes on services that consume external JSON and forward it through axios
Alert on repeated stack-overflow errors originating from a single client IP or API token
Correlate dependency inventory data with runtime crash telemetry to prioritize hosts running unpatched axios builds

How to Mitigate CVE-2026-67321

Immediate Actions Required

Upgrade axios to version 0.33.0 or later on the 0.x branch, or to 1.18.0 or later on the 1.x branch
Audit all server-side services that forward user-supplied objects into axios request options
Wrap axios call sites in try/catch blocks to prevent unhandled RangeError exceptions from terminating worker processes

Patch Information

The axios maintainers addressed the flaw in releases 0.33.0 and 1.18.0. The fix closes the maxDepth bypass for keys ending in {} so that nested values are subject to the same depth limit as other object entries. Consult the GitHub Security Advisory GHSA-hcpx-6fm6-wx23 for the exact commit references and release notes.

Workarounds

Validate and reject inbound object keys whose names end in {} before passing data to axios
Enforce a maximum payload depth at the application boundary using a schema validator such as Ajv or Zod
Isolate outbound axios calls in worker processes or child processes so a RangeError cannot crash the primary request handler

bash

# Upgrade axios to a fixed release
npm install axios@^1.18.0
# or, for projects pinned to the 0.x line
npm install axios@^0.33.0

# Verify the installed version
npm ls axios