Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-67312

CVE-2026-67312: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-67312] Denial of Service via uncontrolled recursion in form data processing

    CVE-2026-67312Source published Source updated

    axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling. A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This…

    Affected products in this advisory
    • Red Hat Developer Hub 1.10
    • Red Hat Developer Hub 1.9
    • Red Hat Hardened Images
    • Red Hat OpenShift Dev Spaces 3.30

    4 more entries in the full advisory.

    Source-reported affected versions
    • < 0.28.0
    • < 0.33.0
    • < 1.0.0
    • < 1.18.0
    Source-reported fixed versions
    • rhdh/rhdh-hub-rhel9:1788286049
    • rhdh/rhdh-hub-rhel9:1789554285
    • grafana12-4-main-12.4.6-0.2.hum1
    • grafana13-1-main-13.1.1-0.3.hum1

    8 more entries in the full advisory.

    Mitigation guidance
    • Upgrade to axios >= 1.18.0 (1.x) or >= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features