CVE-2026-67313 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, opensearch-dashboards, jitsucom-jitsu, prism, lerna, langfuse, nextcloud-server...

CVE-2026-67313

creationtimestamp| type| source ---|---|--- 2026-08-14 14:00:04+00:00| seen| https://t.me/bdufstecru/3385 2026-08-15 00:00:47+00:00| published-proof-of-concept| https://t.me/bdufstecru/3385 2026-09-01 20:35:16+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-42h9-826w-cgv3...

Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS

The version of the axios Node.js module installed on the remote host is 0.28.0 prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - Uncontrolled recursion in formDataToJSON when an application passes attacker-controlled FormData field names with...

CVE-2026-68942

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67313. Reason: This candidate is a duplicate of CVE-2026-67313. Notes: All CVE users should reference CVE-2026-67313 instead of this candidate...

CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...

CVE-2026-67313 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67313

CVE-2026-67313 affects axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x. The formDataToJSON function (in lib/helpers/formDataToJSON.js) performs unbounded recursion in buildPath() when processing FormData field names containing deeply nested bracket segments, causing a RangeError tha...

CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19067 more potentially affected by CVE-2026-67313 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1566 more potentially affected by CVE-2026-67313 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67313 Source advisory: OSV:GHSA-42H9-826W-CGV3...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19067 more potentially affected by CVE-2026-67313 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67313 Source advisory: OSV:GHSA-42H9-826W-CGV3...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1566 more potentially affected by CVE-2026-67313 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...