CVE-2026-67312 is a high severity denial of service in axios caused by uncontrolled recursion in its FormData to JSON conversion. The record scores it 7.5 and the advisory 6.3. Axios 1.18.0 and 0.33.0 fix it. Upgrade, and validate FormData field names that come from users.
What's affected
axios from 0.28.0 before 0.33.0, and from 1.0.0 before 1.18.0. The patched versions are 0.33.0 and 1.18.0, according to the GitHub advisory and the record.
Severity differs. The record gives CVSS 7.5 (High) with availability impact. The axios advisory rates it Moderate, 6.3. The weakness is CWE-400, uncontrolled resource consumption.
A closely related entry, CVE-2026-67313, describes the same recursion in the same helper. Its advisory lists only 1.18.0 as the patched version. Upgrade to the versions named here and you cover both.
The advisory is specific about the conditions. Applications are affected only when untrusted users can control FormData key names that axios converts, either through a direct call to axios.formToJSON() or when FormData is sent with a JSON content type. Plain multipart uploads, and the toFormData helper that already limits depth, are not affected.
How to check if you're exposed
Find every copy of axios, direct and transitive:
npm ls axios
npm why axios
Yarn and pnpm users can run yarn why axios or pnpm why axios. Look at the lockfile too, since a transitive dependency can pin an older copy than your top level package.json suggests.
Then search your code for formToJSON and for places where FormData is sent with a JSON content type. If neither appears, the vulnerable function is not called, though the version is still old.
The advisory says that the failure is a RangeError for maximum call stack size exceeded. In its testing it can be caught, so whether a process dies depends on how your code handles the error.
What to do now
- Upgrade axios to 1.18.0, or 0.33.0 on the 0.x line, in every project and lockfile.
- Search for formToJSON and JSON serialization of FormData in your code.
- Limit the depth and length of field names you accept from users, at the edge.
- Handle rejected promises and thrown errors around these calls so one request cannot take down a worker.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
Recursion that has no depth limit is a denial of service waiting for a long enough input. The function handles one bracket segment per call, so a field name with thousands of segments means thousands of nested calls until the stack runs out.
It is a small bug with a narrow reach, which fits the moderate rating in the advisory. It is still a good example of why reachability matters. Many projects include axios, and few pass untrusted field names to this helper.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is every axios user affected?
No. The advisory says you are affected only if untrusted users control FormData field names converted through axios.
Is this the same as CVE-2026-67313?
They describe the same recursion in the same helper. Upgrading to 1.18.0 or 0.33.0 covers both.
Sources
Last reviewed: 18 October 2026.
