Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-67313 Uncontrolled Recursion in Axios 0.28.0 FormData Processing via Nested Brackets https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-67313
Post summary
A new vulnerability (CVE‑2026‑67313) in Axios 0.28.0 has been disclosed, describing an uncontrolled recursion issue triggered by nested brackets in FormData processing, with no exploit, patch, or active exploitation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |