Uncontrolled Recursion in axios - CVE-2026-67313

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136907

Uncontrolled Recursion in axios - CVE-2026-67313

Published: July 6, 2026 / Updated: September 14, 2026


Vulnerability identifier: #VU136907
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67313
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in formDataToJSON when processing attacker-controlled FormData field names during FormData-to-JSON conversion. A remote attacker can supply a crafted FormData field name with deeply nested bracket segments to cause a denial of service.

The vulnerable request-transform path is reached when FormData is sent with an application/json content type, and direct use of formToJSON() throws synchronously.


Affected software

axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
InfoSphere Optim Archive Viewer
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App

How to mitigate CVE-2026-67313

Install security update from vendor's website.

axios - update to 1.18.0
IBM Fusion HCI - update to 2.14.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2

External References

Related Security Bulletins