GHSA-fq2j-3j99-rx65

GHSA-fq2j-3j99-rx65 PUBLISHED CVSS 6.300000190734863 MEDIUM

Record from GitHub Advisory Database · Published August 1, 2026

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
librechat	Chainguard	0.8.7-r5
prism	Chainguard	5.16.0-r1
kubeflow-centraldashboard	Chainguard	1.10.0-r26
langfuse-fips-3	Chainguard	3.223.0-r0
opensearch-dashboards-3-fips	Chainguard	3.7.0-r7
opensearch-dashboards-3	Wolfi	3.7.0-r11
nextcloud-server-33	Wolfi	33.0.6-r8
langfuse-3	Chainguard	3.223.0-r0
prism	Wolfi	5.16.0-r1
lerna	Wolfi	9.0.7-r11
semaphore	Chainguard	2.18.29-r0
gitlab-rails-ce-19.2	Chainguard	19.2.5-r2

33 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

6.300000190734863

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Vendor	Product	Versions
chainguard	librechat	0
chainguard	prism	0
chainguard	kubeflow-centraldashboard	0
chainguard	langfuse-fips-3	0
chainguard	opensearch-dashboards-3-fips	0
wolfi	opensearch-dashboards-3	0
wolfi	nextcloud-server-33	0
chainguard	langfuse-3	0
wolfi	prism	0
wolfi	lerna	0
chainguard	semaphore	0
chainguard	gitlab-rails-ce-19.2	0
chainguard	opensearch-dashboards-2-fips	0
chainguard	opensearch-dashboards-3	0
chainguard	nextcloud-server-33	0
chainguard	jitsucom-jitsu	0
chainguard	kibana-9.0	0
chainguard	azurite	0
wolfi	langfuse-3	0, 0
chainguard	wazuh-dashboard	0

…and 25 more

Timeline

Aug 1, 2026 CVE Published
Aug 6, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fq2j-3j99-rx65
vulnetix vdb fixes GHSA-fq2j-3j99-rx65

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fq2j-3j99-rx65/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →