Resource exhaustion in axios - CVE-2026-67312

Vulnerability identifier: #VU136906

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-67312

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in formDataToJSON when parsing attacker-controlled FormData field names with deeply nested bracket segments. A remote attacker can send crafted FormData input to cause a denial of service.

The issue affects direct use of axios.formToJSON() and JSON serialization of FormData when the Content-Type contains application/json.

axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
InfoSphere Optim Archive Viewer
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App

Install security update from vendor's website.

axios - addressed in versions 0.33.0, 1.18.0
IBM Fusion HCI - update to 2.14.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2

• https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging