Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-01T12:22:18 axios: axios: Denial of Service via object serialization bypass 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.

Red Hat Hardened Images 2026-07-28T00:00:00Z RHSA-2026:47619 grafana12-4-main-12.4.6-0.2.hum1 Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48241 grafana13-1-main-13.1.1-0.3.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48758 jaeger-main-2.20.0-0.8.hum1 https://www.cve.org/CVERecord?id=CVE-2026-67321 https://nvd.nist.gov/vuln/detail/CVE-2026-67321 https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23 https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass