Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-67321 axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control obje… https://www.cve.org/CVERecord?id=CVE-2026-67321
Post summary
The CVE‑2026‑67321 entry describes an incomplete depth‑limit bypass in axios's toFormData.js, but no proof of concept, exploit code, patch, or active exploitation details are provided.
🚨*CVE* CVE-2026-67321 axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control obje… https://www.cve.org/CVERecord?id=CVE-2026-67321 ----- Traducción: CVE-2026-67321 axi… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-67321, detailing an incomplete depth‑limit bypass in axios’s toFormData.js, but offers no PoC, exploit, patch, or active usage information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |