CVE-2026-67321 is a high severity (CVSS 7.5) denial of service flaw in axios. An incomplete depth limit in its form and parameter serializer lets crafted object keys trigger a stack overflow error in the request path. Upgrade to axios 0.33.0 or 1.18.0, and validate untrusted objects before serializing them.
What's affected
Per the record: axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0. The GitHub advisory (GHSA-hcpx-6fm6-wx23) lists affected ranges as 0.31.1 and later and 1.15.1 and later, with patched releases 0.33.0 and 1.18.0.
The advisory describes this as a follow-up. An earlier depth-limit fix existed, and this issue is a gap left in it. The affected paths it names are the form serializer, the URL-encoded form helper, and default query parameter serialization, along with request transforms that serialize object data.
Severity differs between sources. The NVD record scores it 7.5 (High). The GitHub advisory labels it Moderate. Both are given here. The impact in either case is availability only: the record says a RangeError causes denial of service in the affected request path.
How to check if you're exposed
npm ls axios
npm why axios
npm ls prints every copy of the package in the tree with its version. npm why shows which dependency pulled each copy in, which matters because a transitive copy is not fixed by bumping your own direct dependency.
Then look at what reaches the serializer. The risk is in code that passes objects you do not control into axios as form data or query parameters:
grep -rn "formSerializer\|paramsSerializer\|FormData" src
If request bodies or params are built only from values your own code defines, exposure is low. If they are built from parsed user input, such as a JSON body that you forward, treat the code as in scope.
A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.
What to do now
- Upgrade axios to 0.33.0 or 1.18.0 or later.
- Reject or depth-limit untrusted objects before they reach axios serialization, as the advisory recommends.
- Strip or reject top-level keys that end in a brace pair from untrusted input when you use form serialization.
- For query parameters, supply a custom paramsSerializer with its own depth limit.
- For form bodies, build FormData or URLSearchParams by hand after validating the input shape.
Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.
Why it matters
The weakness is CWE-674, uncontrolled recursion. A depth guard is only useful if it runs before the deep structure is walked. Here one key pattern caused the code to call JSON.stringify on a value before the guard could inspect it, and the deeply nested value exhausted the call stack.
The effect is narrow but real. It does not leak data or run code, but a request path that throws an unhandled error can take down a worker or fail a user flow. If your service forwards untrusted JSON through axios, one malformed request is enough to trigger it. The record does not list this CVE as known exploited.
Quick check
Is this remote code execution?
No. The record describes denial of service through a RangeError in the affected request path.
Why do the sources disagree on severity?
The NVD record gives 7.5 High and the GitHub advisory says Moderate. This post reports both rather than choosing.
Sources
- https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23
- Record: NVD entry for CVE-2026-67321 (score 7.5, HIGH)
Last reviewed: 18 October 2026.
