This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-67321 →

DEBIAN-CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with t...

Original description

The description as published by the source.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}]

References

advisory security-tracker.debian.org