Denial of Service Vulnerability in Axios by Axios

CVE-2026-67321

What is CVE-2026-67321?

Axios versions prior to 0.33.0 are susceptible to a vulnerability that allows attackers to exploit an incomplete depth-limit bypass in the serialization process. This occurs in the toFormData.js file when handling objects with top-level keys that end in '{}'. By manipulating object keys and nested values, an attacker can trigger a RangeError during JSON.stringify operations, leading to a denial of service in the affected request path. It is crucial for users of Axios to update to the latest version to mitigate this risk.

References