Bug 2510007 (CVE-2026-67312)

Summary:	CVE-2026-67312 axios: axios: Denial of Service via uncontrolled recursion in form data processing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, abrianik, abuckta, akhatavk, akostadi, alizardo, amasferr, anjoseph, anthomas, anujha, aos-team-art-private, aruklets, asdas, asoldano, ataylor, bbaranow, bbrownin, bmaxwell, brasmith, bstansbe, cmah, cmyers, cochase, csuconic, dbosanac, dbruscin, dfreiber, dkeler, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drow, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, ewittman, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gparvin, gtully, ibolton, istudens, ivassile, iweiss, janstey, jbalunas, jburrell, jchui, jdelft, jhe, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jpasqual, jprabhak, jraez, jreimann, jsherman, jtolenti, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, lgarciaa, mbiarnes, mcarlett, mdellweg, mdessi, mhulan, mosmerov, mrizzi, msvehla, nboldt, ngough, nipatil, niyer, nmoumoul, nwallace, oaljalju, orabin, osousa, pantinor, parichar, pberan, pcattana, pcreech, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, prwatson, psrna, rchan, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rstancel, rstepani, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sseago, stcannon, suppawar, tasato, tbish, tcunning, teagle, thason, thjenkin, tlavocat, tmalecek, tsedmik, tsze, twaugh, vdosoudi, veshanka, vkumar, vlaad, watson-tool-maintainers, wtam, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application's JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-01 13:02:59 UTC

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.