axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Published Aug 1, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.53%
Description
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Affected products
-
- Version 0.31.1StatusaffectedConstraints<0.33.0
- Version 1.15.1StatusaffectedConstraints<1.18.0
- Version 0.33.0StatusunaffectedConstraints-
- Version 1.18.0StatusunaffectedConstraints-
- Version
No data.
Red Hat Advanced Cluster Management for Kubernetes 2.13
rhacm2/console-rhel9:1787339249
Fixed · RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14
rhacm2/console-rhel9:1787339248
Fixed · RHSA-2026:60388
Red Hat Advanced Cluster Security for Kubernetes 4.10
advanced-cluster-security/rhacs-main-rhel8:1789411269
Fixed · RHSA-2026:67711
Red Hat Advanced Cluster Security for Kubernetes 4.11
advanced-cluster-security/rhacs-main-rhel9:1789411320
Fixed · RHSA-2026:67714
Red Hat Ansible Automation Platform 2.1
ansible-automation-platform/automation-portal:1788775748
Fixed · RHSA-2026:65118
Red Hat Hardened Images
grafana12-4-main-12.4.6-0.2.hum1
Fixed · RHSA-2026:47619
Red Hat Hardened Images
grafana13-1-main-13.1.1-0.3.hum1
Fixed · RHSA-2026:48241
Red Hat Hardened Images
jaeger-main-2.20.0-0.8.hum1
Fixed · RHSA-2026:48758
Red Hat Migration Toolkit 1.8
rhmtc/openshift-migration-ui-rhel8:1789546373
Fixed · RHSA-2026:68681
Red Hat OpenShift Dev Spaces 3.30
devspaces/dashboard-rhel9:1789162884
Fixed · RHSA-2026:68754
Red Hat OpenShift Service Mesh 3.3
openshift-service-mesh/kiali-ossmc-rhel9:1787076322
Fixed · RHSA-2026:59566
Red Hat OpenShift Service Mesh 3.3
openshift-service-mesh/kiali-rhel9:1787077108
Fixed · RHSA-2026:59566
Red Hat OpenShift Service Mesh 3.4
openshift-service-mesh/kiali-ossmc-rhel9:1787166293
Fixed · RHSA-2026:59583
Red Hat OpenShift Service Mesh 3.4
openshift-service-mesh/kiali-rhel9:1787165683
Fixed · RHSA-2026:59583
Red Hat Quay 3.10
quay/quay-rhel8:1788561841
Fixed · RHSA-2026:66084
Red Hat Quay 3.12
quay/quay-rhel8:1788594376
Fixed · RHSA-2026:66523
Red Hat Quay 3.16
quay/quay-rhel9:1789563753
Fixed · RHSA-2026:69255
Red Hat Quay 3.9
quay/quay-rhel8:1788595574
Fixed · RHSA-2026:65514
Red Hat Satellite 6.18
satellite/iop-host-inventory-frontend-rhel9:1788322243
Fixed · RHSA-2026:63373
Red Hat Satellite 6.18
satellite/iop-vulnerability-frontend-rhel9:1789660969
Fixed · RHSA-2026:68765
Red Hat Satellite 6.19
satellite/iop-advisor-frontend-rhel9:1789659565
Fixed · RHSA-2026:68748
Red Hat Satellite 6.19
satellite/iop-host-inventory-frontend-rhel9:1788260941
Fixed · RHSA-2026:63355
Red Hat Satellite 6.19
satellite/iop-vulnerability-frontend-rhel9:1789660983
Fixed · RHSA-2026:68755
Migration Toolkit for Applications 8
mta/mta-ui-rhel9
Affected
Multicluster Engine for Kubernetes
multicluster-engine/console-mce-rhel9
Affected
Network Observability Operator
network-observability/network-observability-console-plugin-pf4-rhel9
Not affected
Network Observability Operator
network-observability/network-observability-console-plugin-pf5-rhel9
Not affected
Network Observability Operator
network-observability/network-observability-console-plugin-rhel9
Not affected
OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel9
Affected
Red Hat Ansible Automation Platform 2
automation-gateway
Will not fix
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mlflow-rhel9
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-automl-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-autorag-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-eval-hub-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-gen-ai-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-maas-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-mlflow-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-model-registry-rhel9
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-console
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-console-rhel9
Not affected
Red Hat OpenShift Dev Spaces
devspaces/code-rhel9
Affected
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin-rhel9
Not affected
Red Hat Trusted Profile Analyzer
rhtpa/rhtpa-rhel10
Affected
Red Hat Trusted Profile Analyzer
rhtpa/rhtpa-trustification-service-rhel9
Affected
Red Hat build of Apicurio Registry 3
apicurio/apicurio-registry-ui-rhel8
Not affected
Red Hat build of Apicurio Registry 3
apicurio/apicurio-registry-ui-rhel9
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | rhacm2/console-rhel9:1787339249 | Fixed | RHSA-2026:60390 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | rhacm2/console-rhel9:1787339248 | Fixed | RHSA-2026:60388 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 | advanced-cluster-security/rhacs-main-rhel8:1789411269 | Fixed | RHSA-2026:67711 |
| Red Hat Advanced Cluster Security for Kubernetes 4.11 | advanced-cluster-security/rhacs-main-rhel9:1789411320 | Fixed | RHSA-2026:67714 |
| Red Hat Ansible Automation Platform 2.1 | ansible-automation-platform/automation-portal:1788775748 | Fixed | RHSA-2026:65118 |
| Red Hat Hardened Images | grafana12-4-main-12.4.6-0.2.hum1 | Fixed | RHSA-2026:47619 |
| Red Hat Hardened Images | grafana13-1-main-13.1.1-0.3.hum1 | Fixed | RHSA-2026:48241 |
| Red Hat Hardened Images | jaeger-main-2.20.0-0.8.hum1 | Fixed | RHSA-2026:48758 |
| Red Hat Migration Toolkit 1.8 | rhmtc/openshift-migration-ui-rhel8:1789546373 | Fixed | RHSA-2026:68681 |
| Red Hat OpenShift Dev Spaces 3.30 | devspaces/dashboard-rhel9:1789162884 | Fixed | RHSA-2026:68754 |
| Red Hat OpenShift Service Mesh 3.3 | openshift-service-mesh/kiali-ossmc-rhel9:1787076322 | Fixed | RHSA-2026:59566 |
| Red Hat OpenShift Service Mesh 3.3 | openshift-service-mesh/kiali-rhel9:1787077108 | Fixed | RHSA-2026:59566 |
| Red Hat OpenShift Service Mesh 3.4 | openshift-service-mesh/kiali-ossmc-rhel9:1787166293 | Fixed | RHSA-2026:59583 |
| Red Hat OpenShift Service Mesh 3.4 | openshift-service-mesh/kiali-rhel9:1787165683 | Fixed | RHSA-2026:59583 |
| Red Hat Quay 3.10 | quay/quay-rhel8:1788561841 | Fixed | RHSA-2026:66084 |
| Red Hat Quay 3.12 | quay/quay-rhel8:1788594376 | Fixed | RHSA-2026:66523 |
| Red Hat Quay 3.16 | quay/quay-rhel9:1789563753 | Fixed | RHSA-2026:69255 |
| Red Hat Quay 3.9 | quay/quay-rhel8:1788595574 | Fixed | RHSA-2026:65514 |
| Red Hat Satellite 6.18 | satellite/iop-host-inventory-frontend-rhel9:1788322243 | Fixed | RHSA-2026:63373 |
| Red Hat Satellite 6.18 | satellite/iop-vulnerability-frontend-rhel9:1789660969 | Fixed | RHSA-2026:68765 |
| Red Hat Satellite 6.19 | satellite/iop-advisor-frontend-rhel9:1789659565 | Fixed | RHSA-2026:68748 |
| Red Hat Satellite 6.19 | satellite/iop-host-inventory-frontend-rhel9:1788260941 | Fixed | RHSA-2026:63355 |
| Red Hat Satellite 6.19 | satellite/iop-vulnerability-frontend-rhel9:1789660983 | Fixed | RHSA-2026:68755 |
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Affected | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Affected | n/a |
| Network Observability Operator | network-observability/network-observability-console-plugin-pf4-rhel9 | Not affected | n/a |
| Network Observability Operator | network-observability/network-observability-console-plugin-pf5-rhel9 | Not affected | n/a |
| Network Observability Operator | network-observability/network-observability-console-plugin-rhel9 | Not affected | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel9 | Affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway | Will not fix | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-automl-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-autorag-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-eval-hub-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-maas-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-mlflow-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Not affected | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel9 | Affected | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin-rhel9 | Not affected | n/a |
| Red Hat Trusted Profile Analyzer | rhtpa/rhtpa-rhel10 | Affected | n/a |
| Red Hat Trusted Profile Analyzer | rhtpa/rhtpa-trustification-service-rhel9 | Affected | n/a |
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel8 | Not affected | n/a |
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-registry-ui-rhel9 | Affected | n/a |
axios
npm
Introduced 0.31.1 Fixed 0.33.0axios
npm
Introduced 1.15.1 Fixed 1.18.0
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | axios | 0.31.1 | 0.33.0 |
| npm | axios | 1.15.1 | 1.18.0 |
Remediation
No remediation recorded yet.
References (14)
- https://access.redhat.com/security/cve/CVE-2026-67321 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2510011 Issue Tracking
- https://github.com/advisories/GHSA-hcpx-6fm6-wx23 Advisory
- https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d
- https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
- https://github.com/axios/axios/pull/11000
- https://github.com/axios/axios/pull/11001
- https://github.com/axios/axios/releases/tag/v0.33.0
- https://github.com/axios/axios/releases/tag/v1.18.0
- https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23 exploitvendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-67321
- https://nvd.nist.gov/vuln/detail/CVE-2026-69125
- https://www.cve.org/CVERecord?id=CVE-2026-67321
- https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass third-party-advisoryThird Party Advisory
Change history (0)
No recorded changes yet.