Npm · Axios · CVE-2026-67312
**Name of the Vulnerable Software and Affected Versions**
axios versions 0.28.0 through 0.32.x
axios versions 1.0.0 through 1.17.x
**Description**
Uncontrolled recursion exists in the `formDataToJSON` function, which is exposed as `axios.formToJSON()` and used internally when serializing `FormData` with `Content-Type: application/json`. If an application processes attacker-controlled `FormData` field names, a field name containing thousands of nested bracket-delimited segments can trigger unbounded recursion in the `buildPath()` function. This exhausts the JavaScript call stack, resulting in a `RangeError: Maximum call stack size exceeded`, which leads to a denial of service for the request or complete process termination in applications lacking appropriate error handling.
**Recommendations**
Update axios to version 0.33.0 or later.
Update axios to version 1.18.0 or later.
As a temporary workaround, reject or normalize untrusted form field names before calling `axios.formToJSON()`.
Avoid sending untrusted `FormData` through axios as JSON unless conversion is strictly required.
Implement error handling to catch exceptions around `formToJSON()` or axios requests that transform untrusted `FormData`.