CVE-2026-67321
Fixed in a distro release EPSS <1%CVSS 6.9
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 0.33.0 |
| npm | axios | 1.18.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r45 |
| Chainguard | azurite | 3.35.0-r2 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r30 |
| Chainguard | kibana-8.17 | 8.17.10-r31 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r31 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r31 |
| Chainguard | kibana-8.19 | 8.19.18-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.18-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.18-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.1 | 9.1.10-r30 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r30 |
| Chainguard | kibana-9.2 | 9.2.8-r18 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r18 |
| Chainguard | kibana-9.3 | 9.3.8-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.8-r1 |
| Chainguard | kibana-9.4 | 9.4.4-r3 |
| Chainguard | kibana-9.4-iamguarded | 9.4.4-r3 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r26 |
| Chainguard | langfuse-2 | 2.95.12-r35 |
| Chainguard | langfuse-2-worker | 2.95.12-r35 |
| Chainguard | langfuse-3 | 3.223.0-r0 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.223.0-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r38 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r38 |
| Chainguard | langfuse-fips-3 | 3.223.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.223.0-r0 |
| Chainguard | lerna | 9.0.7-r11 |
| Chainguard | librechat | 0.8.7-r5 |
| Chainguard | nextcloud-server-32 | 32.0.12-r6 |
| Chainguard | nextcloud-server-33 | 33.0.6-r8 |
| Chainguard | nextcloud-server-34 | 34.0.2-r4 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r7 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r21 |
| Chainguard | opensearch-dashboards-3 | 3.7.0-r11 |
| Chainguard | opensearch-dashboards-3-fips | 3.7.0-r7 |
| Chainguard | prism | 5.16.0-r1 |
| Chainguard | redisinsight | 3.8.0-r1 |
| Chainguard | semaphore | 2.18.29-r0 |
| Chainguard | wazuh-dashboard | 4.14.6-r6 |
| Chainguard | wazuh-dashboard-fips | 4.14.6-r6 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.18.0-1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.6-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.1-0.3.hum1 |
| Red Hat hummingbird 1 | jaeger | 0:2.20.0-0.8.hum1 |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r30 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r26 |
| Wolfi | langfuse-3 | 3.223.0-r0 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.223.0-r0 |
| Wolfi | lerna | 9.0.7-r11 |
| Wolfi | nextcloud-server-32 | 32.0.12-r6 |
| Wolfi | nextcloud-server-33 | 33.0.6-r8 |
| Wolfi | opensearch-dashboards-3 | 3.7.0-r11 |
| Wolfi | prism | 5.16.0-r1 |
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 |