Description
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | 0.31.1 – < 0.33.0, 1.15.1 – < 1.18.0 | 0.33.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.18.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
| Debian 12 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.2.hum1 | RHSA-2026:47619 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.3.hum1 | RHSA-2026:48241 |
| Red Hat Hardened Images 1 | jaeger | 2.20.0-0.8.hum1 | RHSA-2026:48758 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r30 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r26 | — |
| Wolfi rolling | langfuse-3 +1 | 3.223.0-r0 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | lerna | 9.0.7-r11 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r8 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r11 | — |
| Wolfi rolling | prism | 5.16.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 0.31.1, < 0.33.0 | 0.33.0 | GHSA-hcpx-6fm6-wx23 |
| npm | axios | >= 1.15.1, < 1.18.0 | 1.18.0 | GHSA-hcpx-6fm6-wx23 |
Advisories 5
- RHSA-2026:48758 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:48241 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:47619 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2958 IBM License Metric Tool: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
References
- GitHub Security Advisory (GHSA-hcpx-6fm6-wx23) vendor-advisory
- VulnCheck Advisory: axios before 0.33.0 Denial of Service via maxDepth bypass third-party-advisory