CVE-2026-67321 axios CVE debrief

Who should care

Developers and administrators using axios versions before 0.33.0 should review and potentially update to mitigate potential denial of service via incomplete depth-limit bypass. Security teams and vulnerability management teams should assess exposure and prioritize remediation based on operational impact and asset criticality.

Technical summary

Axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. This can cause a RangeError from JSON.stringify, potentially leading to denial of service in the affected request path due to excessive recursion. The vulnerability affects request paths using axios form or parameter serialization. Security teams and vulnerability management teams should assess exposure and prioritize remediation based on operational impact and asset criticality. Review axios versions before 0.33.0 for potential vulnerability and consider upgrading axios to version 0.33.0 or later.

Defensive priority

Medium-priority defensive review recommended due to potential denial of service via incomplete depth-limit bypass.

Recommended defensive actions

• Review axios versions before 0.33.0 for potential vulnerability
• Assess if applications using axios are exposed to denial of service via incomplete depth-limit bypass
• Consider upgrading axios to version 0.33.0 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from official CVE and NVD sources indicates an incomplete depth-limit bypass in axios toFormData.js, potentially affecting request paths. Further review needed to assess affected scope, impact, and verify with source details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.