CVE-2026-67313 is a high severity denial of service in axios formDataToJSON, caused by excessive recursion on deeply nested field names. The record scores it 7.5 and the advisory 6.3. The advisory lists axios 1.18.0 as the patched version, so upgrade to 1.18.0 or later.
What's affected
The record says axios 0.28.0 and later contain the flaw. The GitHub advisory says affected versions are 0.28.0 and later, with a patched version of 1.18.0 or later. It does not list a patched 0.x release, although the sibling advisory for CVE-2026-67312 lists 0.33.0. If you are on the 0.x line, use 0.33.0 from that advisory or move to 1.x.
Severity differs. The record gives CVSS 7.5 (High). The advisory rates it Moderate, 6.3. The weakness is CWE-400, uncontrolled resource consumption.
The function converts a form field name such as a bracketed path into nested JSON. The advisory says it recurses once per segment with no maximum depth. A field name with thousands of nested bracket segments exhausts the call stack and throws a RangeError.
The advisory says the vulnerable path is not reached by installing axios, by multipart FormData pass-through, or by ordinary requests that do not ask for JSON serialization of FormData. In the default request, the error happens before any network call and is returned as a rejected promise. A direct call to formToJSON() throws synchronously.
How to check if you're exposed
Find every copy of axios, direct and transitive:
npm ls axios
npm why axios
Yarn and pnpm users can run yarn why axios or pnpm why axios. Look at the lockfile too, since a transitive dependency can pin an older copy than your top level package.json suggests.
Search your code for formToJSON and for FormData requests that set a JSON content type. Server side applications are the main risk, when remote users can submit arbitrary field names and the application converts them.
What to do now
- Upgrade axios to 1.18.0 or later.
- On 0.x, move to 0.33.0 or to 1.x.
- Reject field names beyond a sensible length or depth where input enters your application.
- Make sure rejected promises and exceptions from these calls are handled.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
Denial of service bugs of this kind are cheap for an attacker. One request with a long field name can fail a request or, if errors go unhandled, stop a process. The advisory is careful to say a process crash depends on how the application handles the error.
Two CVE numbers exist for the same helper because two reports described the same problem. For your remediation work, one upgrade closes both, so avoid tracking them as separate projects.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Which versions fix it?
The advisory lists 1.18.0 or later. For 0.x, the sibling advisory for CVE-2026-67312 lists 0.33.0.
Is a crash guaranteed?
No. The advisory says the error can be caught, and a crash depends on how your application handles it.
Sources
Last reviewed: 18 October 2026.
