CVE-2026-67312: 
Grafana vulnerability analysis and mitigation

CVE-2026-67312 is a Denial of Service vulnerability in the axios HTTP client library caused by uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). It affects axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x. The vulnerability was published on August 1, 2026, with patches available in versions 0.33.0 and 1.18.0. It carries a CVSS v4 base score of 6.3 (Medium) (GitHub Advisory, axios Security Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and unchecked input for loop condition (CWE-606) in lib/helpers/formDataToJSON.js. The parsePropPath() function splits a FormData field name such as a[x][x][x]... into path segments, and buildPath() then recursively processes one segment per call with no maximum depth guard. A field name containing approximately 15,000 or more bracket-delimited segments produces a call stack depth that exceeds the JavaScript engine's limit (typically ~10,000–15,000 frames in V8), triggering a RangeError: Maximum call stack size exceeded. Notably, the inverse function toFormData already enforces a maxDepth guard (default 100) with an ERR_FORM_DATA_DEPTH_EXCEEDED error, but formDataToJSON lacks an equivalent protection. A public proof-of-concept is included in the official advisory (axios Security Advisory, Red Hat Bugzilla).

Successful exploitation causes denial of service for the affected request or, in applications without appropriate error handling, termination of the entire Node.js process. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Applications are at risk only when untrusted users can control FormData key names that are processed through axios.formToJSON() or when attacker-controlled FormData is sent via axios with Content-Type: application/json, making server-side applications that accept user-submitted form data the primary affected asset (axios Security Advisory, GitHub Advisory).

A proof-of-concept is included in the official axios security advisory and requires only Node.js and an unmodified affected axios installation. The EPSS score is 0.338% (27th percentile), indicating a low but non-negligible probability of exploitation in the wild within 30 days. NVD SSVC assessment classifies exploitation status as "poc" with non-automatable exploitation and partial technical impact. No active in-the-wild exploitation or threat actor attribution has been reported as of the time of publication (GitHub Advisory, axios Security Advisory).

1. Identify target: Locate a Node.js application that uses a vulnerable axios version (0.28.0–0.32.x or 1.0.0–1.17.x) and accepts user-controlled FormData that is processed via axios.formToJSON() or sent with Content-Type: application/json.
2. Craft malicious FormData: Construct a FormData object with a single field whose name contains thousands of nested bracket-delimited segments, e.g., a followed by [x] repeated 15,000 times: const key = 'a' + '[x]'.repeat(15000);
3. Submit the payload: Send an HTTP request to the target application endpoint with the crafted FormData, either as a multipart form submission that the server passes to axios.formToJSON(), or directly as a JSON-serialized FormData body with Content-Type: application/json.
4. Trigger stack exhaustion: The buildPath() function in formDataToJSON.js recursively processes each bracket segment without a depth limit, causing ~15,001 recursive calls that exceed the V8 call stack limit and throw RangeError: Maximum call stack size exceeded.
5. Achieve DoS: If the application lacks proper error handling around formToJSON() or the axios request transformation, the unhandled RangeError terminates the Node.js process, taking down the server (axios Security Advisory).

• Logs: Node.js process logs or application error logs showing RangeError: Maximum call stack size exceeded originating from formDataToJSON.js or buildPath(); unexpected process crash/restart events in process managers (e.g., PM2, systemd) coinciding with incoming form submissions.
• Network: HTTP requests to form-accepting endpoints with unusually long field names containing repetitive bracket patterns (e.g., a%5Bx%5D%5Bx%5D... URL-encoded); single requests causing disproportionate server response time or connection drops.
• Process: Sudden termination of the Node.js process without a graceful shutdown signal; process manager logs indicating repeated restarts triggered by unhandled exceptions (axios Security Advisory).

Upgrade axios to version 0.33.0 or later (for the 0.x branch) or 1.18.0 or later (for the 1.x branch), which add a depth guard equivalent to the one already present in toFormData (axios Security Advisory, GitHub Advisory). If immediate upgrade is not possible, apply the following workarounds:

• Validate and reject FormData field names containing excessive bracket-delimited segments before passing them to axios.formToJSON().
• Avoid sending untrusted FormData through axios with Content-Type: application/json unless JSON conversion is strictly required.
• Wrap all calls to formToJSON() or axios requests that transform untrusted FormData in try/catch blocks to prevent unhandled RangeError from crashing the process.
• IBM has also released patches for affected products: IBM Security Verify Information Queue and IBM DevOps Solution Workbench (IBM Advisory, IBM DevOps Advisory).

The vulnerability was reported by security researcher sam-caldwell and published by axios maintainer jasonsaayman via the official GitHub Security Advisory on July 6, 2026. Red Hat triaged the issue with high priority and severity in their Bugzilla tracker, with 124 users CC'd, indicating broad internal concern across Red Hat product lines. IBM subsequently issued security bulletins for multiple affected products. No significant public social media discussion or notable independent researcher commentary has been identified beyond the official advisory channels (axios Security Advisory, Red Hat Bugzilla).