CVE-2026-67321

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Uncontrolled Recursion pada axios. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23 exploit · advisory vendor
• https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass advisory pihak ketiga