VDB

CVE-2026-67313

CVE-2026-67313 PUBLISHED CVSS 6.3 MEDIUM

Reported by VulnCheck · Published August 1, 2026

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Risk Scores

CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
axiosaxios0.28.0, 1.18.0
chainguardlangfuse-30, 0, 0
chainguardkibana-9.10, 0, 0
chainguardnextcloud-server-310, 0, 0
chainguardarangodb-3.110, 0
chainguardgitlab-rails-ce-19.30, 0
chainguardopensearch-dashboards-20, 0, 0
wolfinextcloud-server-320, 0, 0
chainguardkibana-9.40, 0, 0
chainguardgitlab-rails-ce-fips-19.20, 0
chainguardopensearch-dashboards-3-fips0, 0, 0
chainguardgitlab-rails-ce-fips-19.10, 0
chainguardlangfuse-fips-30, 0, 0
chainguardkubeflow-centraldashboard0, 0, 0
wolfilangfuse-30, 0, 0
wolfiopensearch-dashboards-30, 0, 0
chainguardjitsucom-jitsu0, 0, 0
chainguardopensearch-dashboards-30, 0, 0
chainguardgitlab-rails-ce-19.10, 0
wolfilerna0, 0, 0

…and 27 more

Timeline

  • Jul 20, 2026 CVE Published
  • Aug 1, 2026 Coalition ESS Score
  • Aug 2, 2026 EPSS Score
  • Aug 3, 2026 Security Advisory
  • Aug 3, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 2, 2026 EPSS Score
  • Sep 2, 2026 Security Advisory
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›