Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333254);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/07");

  script_cve_id("CVE-2026-67312", "CVE-2026-67313");
  script_cwe_id(400);

  script_name(english:"Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by multiple denial of service vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the axios Node.js module installed on the remote host is 0.28.0 prior to 0.33.0 or 1.x prior to 1.18.0.
It is, therefore, affected by multiple vulnerabilities:

  - Uncontrolled recursion in formDataToJSON when an application passes attacker-controlled FormData field names
    with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting
    the JavaScript call stack and causing denial of service. (CVE-2026-67312)

  - Uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket
    segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust
    the JavaScript call stack and trigger RangeError. (CVE-2026-67313)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?279fe1ea");
  # https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6a913c5a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to axios version 0.33.0 / 1.18.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67312");

  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:axios:axios");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'axios');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'axios');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'min_version' : '0.28.0', 'fixed_version' : '0.33.0' },
  { 'min_version' : '1.0.0', 'fixed_version' : '1.18.0' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);