VDB
RHSA-2026:50826
RHSA-2026:50826
PUBLISHED
CVSS 8.600000381469727 HIGH
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana13.1-0:13.1.1-0.5.2.hum1@aarch64 as a component of Red Hat Hardened Images | 13.1-0 |
| Red Hat | grafana13.1-0:13.1.1-0.5.2.hum1@src as a component of Red Hat Hardened Images | 13.1-0 |
| Red Hat | grafana13.1-0:13.1.1-0.5.2.hum1@x86_64 as a component of Red Hat Hardened Images | 13.1-0 |
Timeline
- Aug 5, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50826 advisory
- https://access.redhat.com/security/cve/CVE-2026-67313 advisory
- https://access.redhat.com/security/cve/CVE-2026-67314 advisory
- https://access.redhat.com/security/cve/CVE-2026-67315 advisory
- https://access.redhat.com/security/cve/CVE-2026-67316 advisory
- https://access.redhat.com/security/cve/CVE-2026-67317 advisory
- https://access.redhat.com/security/cve/CVE-2026-67318 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69153 advisory
- https://access.redhat.com/security/cve/CVE-2026-69192 advisory
- https://access.redhat.com/security/cve/CVE-2026-69198 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json advisory
- https://www.cve.org/CVERecord?id=CVE-2026-67313 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2510030 issue
- https://www.cve.org/CVERecord?id=CVE-2026-67314 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-67314 advisory
- https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g advisory
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields advisory
…and 46 more