CVE-2026-67312 in axios targets the formToJSON function, and the CVSS 6.3 score is a significant miscalculation that masks the actual risk. The CVE describes denial of service at the request level, but the parenthetical in the description — "process termination in applications without appropriate error handling" — is the real threat. When a deeply nested FormData field name triggers Maximum call stack size exceeded in the bracket-path parsing logic, Node.js processes handling synchronous serialization can crash entirely. This is not a request-level failure; it's a process-kill vulnerability in server-side environments where multiple requests share worker processes.
The attack vector is straightforward: send a FormData payload with a field name containing thousands of nested brackets (e.g., a[repeated 1000 times]). The formToJSON function uses recursive bracket-path parsing inherited from query-string conventions, but FormData field names have no natural length constraints the way URLs do. Axios internally uses this function when serializing FormData with Content-Type: application/json, meaning the vulnerable code path executes even when developers never call formToJSON directly.
The architectural failure is that axios exposed this parsing utility for external data processing without recursion guards. A function designed to handle arbitrary FormData from untrusted sources must treat malicious input as a first-class assumption, not an edge case. The fix should include depth limits, but consider whether the bracket-path parsing model borrowed from query-string handling is appropriate for FormData at all — FormData field names don't conventionally use nested bracket notation, making this an asymmetric parsing surface.
For defenders: audit whether your application uses axios to serialize FormData with Content-Type: application/json, particularly in Node.js backends. Wrap any direct calls to formToJSON in try/catch to prevent process termination. Monitor for the specific error pattern "Maximum call stack size exceeded" in your logs — it's a strong indicator of exploitation attempts. The CVSS rating should not govern your response priority; treat this as critical given the process-termination potential in server-side deployments.