CVE-2026-67312 axios CVE debrief

Who should care

Developers and administrators using axios in their applications should be aware of this vulnerability and take steps to mitigate it. Affected operators should prioritize patching to prevent potential denial-of-service attacks. Vulnerability management and security teams should review the official advisory and CVE record to validate affected systems and implement necessary mitigations. Platform administrators should validate and sanitize FormData field names to prevent exploitation. Security teams should implement error handling for axios formDataToJSON to prevent process termination.

Technical summary

Axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 are vulnerable to uncontrolled recursion in formDataToJSON. This could lead to denial-of-service attacks when an application passes attacker-controlled FormData field names. The vulnerability can cause a RangeError: Maximum call stack size exceeded, leading to process termination in applications without appropriate error handling.

Defensive priority

Axios users should prioritize patching to prevent potential denial-of-service attacks.

Recommended defensive actions

• Update axios to version 0.33.0 or later
• Update axios to version 1.18.0 or later
• Validate and sanitize FormData field names
• Implement error handling for axios formDataToJSON
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON. This could lead to denial-of-service attacks when an application passes attacker-controlled FormData field names. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should review the official advisory and CVE record to validate affected systems and implement necessary mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.