Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-67321 →

DEBIAN-CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with t...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-axios

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}]

Références

advisory security-tracker.debian.org