Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-08-01T12:22:18
axios: axios: Denial of Service via uncontrolled recursion in form data processing
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-674
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.
Red Hat Hardened Images
2026-07-28T00:00:00Z
RHSA-2026:47619
grafana12-4-main-12.4.6-0.2.hum1
Red Hat Hardened Images
2026-07-29T00:00:00Z
RHSA-2026:48241
grafana13-1-main-13.1.1-0.3.hum1
Red Hat Hardened Images
2026-07-30T00:00:00Z
RHSA-2026:48758
jaeger-main-2.20.0-0.8.hum1
Cryostat 4
Under investigation
axios
Cryostat 4
Under investigation
cryostat-openshift-console-plugin-npm
Gatekeeper 3
Under investigation
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Under investigation
mta/mta-ui-rhel9
Migration Toolkit for Containers
Under investigation
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Under investigation
multicluster-engine/console-mce-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-rhel9
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp20/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp24/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp25/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp26/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Under investigation
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Under investigation
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Under investigation
amq-broker-bin.zip
Red Hat AMQ Broker 7
Under investigation
amq-broker-maven-repository.zip
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
automation-controller
Red Hat Ansible Automation Platform 2
Under investigation
automation-gateway
Red Hat Ansible Automation Platform 2
Under investigation
automation-hub
Red Hat Ansible Automation Platform 2
Under investigation
automation-platform-ui
Red Hat Ansible Automation Platform 2
Under investigation
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Under investigation
rhaf-camel-for-springboot-maven-repository.zip
Red Hat build of Apache Camel for Spring Boot 4
Under investigation
rhaf-camel-spring-boot-maven-repository.zip
Red Hat build of Apache Camel - HawtIO 4
Under investigation
axios
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel9
Red Hat Data Grid 8
Under investigation
redhat-datagrid-maven-repository.zip
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Under investigation
discovery/discovery-ui-rhel9
Red Hat Enterprise Linux 8
Under investigation
grafana
Red Hat Enterprise Linux 9
Under investigation
grafana
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/disk-image-cuda-rhel9
Red Hat JBoss Enterprise Application Platform Expansion Pack
Under investigation
axios-1.7.7.tgz
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Under investigation
odf4/mcg-core-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/dashboard-rhel9
Red Hat OpenShift Virtualization 4
Under investigation
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Under investigation
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Under investigation
quay/quay-rhel8
Red Hat Quay 3
Under investigation
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
nodejs-axios
Red Hat Satellite 6
Under investigation
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-vulnerability-frontend-rhel9
Red Hat Trusted Artifact Signer
Under investigation
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Under investigation
rhtpa/rhtpa-trustification-service-rhel9
Red Hat Trusted Profile Analyzer
Under investigation
rhtpa/rhtpa-rhel10
Self-service automation portal 2
Under investigation
ansible-automation-platform/automation-portal
Self-service automation portal 2
Under investigation
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-67312
https://nvd.nist.gov/vuln/detail/CVE-2026-67312
https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson