Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.3%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-67321
  • Axios » Axios » Version: 0.31.1
    cpe:2.3:a:axios:axios:0.31.1
  • Axios » Axios » Version: 0.32.0
    cpe:2.3:a:axios:axios:0.32.0
  • Axios » Axios » Version: 1.15.1
    cpe:2.3:a:axios:axios:1.15.1
  • Axios » Axios » Version: 1.15.2
    cpe:2.3:a:axios:axios:1.15.2
  • Axios » Axios » Version: 1.16.0
    cpe:2.3:a:axios:axios:1.16.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved