Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-01T12:22:16 axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-674

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.

Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48758 jaeger-main-2.20.0-0.8.hum1 Red Hat Hardened Images 2026-08-03T00:00:00Z RHSA-2026:49714 grafana13-1-main-13.1.1-0.5.hum1 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50826 grafana13-1-main-13.1.1-0.5.2.hum1 Red Hat Hardened Images Not affected grafana12.4 https://www.cve.org/CVERecord?id=CVE-2026-67313 https://nvd.nist.gov/vuln/detail/CVE-2026-67313 https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3 https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson