Uncontrolled Recursion in axios - CVE-2026-67321
Published: July 6, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU136919
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67321
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in lib/helpers/toFormData.js when serializing an object with a top-level key ending in {} and a deeply nested object value. A remote attacker can supply crafted object keys and nested values to trigger a stack overflow and cause a denial of service.
The issue affects form and parameter serialization paths that delegate to toFormData, and the thrown error is a raw RangeError rather than the intended AxiosError depth-limit signal.
Affected software
axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
Data Cataloging
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
Data Cataloging
How to mitigate CVE-2026-67321
Install security update from vendor's website.
axios - addressed in versions 0.33.0, 1.18.0
IBM Fusion HCI - update to 2.14.0
Data Cataloging - update to 2.5.6
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
IBM Fusion HCI - update to 2.14.0
Data Cataloging - update to 2.5.6
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2