axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in
    toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object
    keys and nested values passed to axios form or parameter serialization can trigger a RangeError from
    JSON.stringify, causing denial of service in the affected request path. (CVE-2026-67321)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.1 prior to 1.18.0. It is, therefore, affected by a vulnerability:

  - An incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in     '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization     can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
    (CVE-2026-67321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in     toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object     keys and nested values passed to axios form or parameter serialization can trigger a RangeError from     JSON.stringify, causing denial of service in the affected request path. (CVE-2026-67321)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457468	Echo: axios: security update to 0.33.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457468	Echo: axios: security update to 0.33.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
333251	Node.js Module axios 0.31.1 < 0.33.0 / 1.15.1 < 1.18.0 DoS (CVE-2026-67321)	Nessus	Misc.	Local	medium
331612	Linux Distros Unpatched Vulnerability : CVE-2026-67321	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-67321

medium

Tenable Plugins

medium

medium

medium

medium