CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

UBUNTU-CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-67321 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

EUVD-2026-51812

axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denia...

CVE-2026-67321

axios (Node.js HTTP client) versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js . When objects with top-level keys ending in '{}' are serialized, the bypass allows uncontrolled recursion (CWE-674) that triggers a RangeError from JSON.st...

CVE-2026-67321 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-71404

Summary: CVE-2025-71404 affects better-auth versions after 0.0.2 and before 1.1.16. The vulnerability is a reflected XSS on the /api/auth/error page where the URL parameter error is echoed into HTML without proper neutralization, enabling arbitrary JavaScript when a user visits a crafted link. Im...

EUVD-2025-210583

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-67313

CVE-2026-67313 affects axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x. The formDataToJSON function (in lib/helpers/formDataToJSON.js) performs unbounded recursion in buildPath() when processing FormData field names containing deeply nested bracket segments, causing a RangeError tha...

EUVD-2026-51866

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67313 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

EUVD-2026-51628

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

CVE-2026-53551 free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...