PT-2026-35049 · Npm · Axios

Fg0X0 · CVE-2026-42039 · Publicado 2026-04-24 · Atualizado 2026-07-28

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Axios versões anteriores a 1.15.1 Axios versões anteriores a 0.31.1

Description A função toFormData processa objetos aninhados recursivamente sem limite de profundidade. Consequentemente, o fornecimento de um valor profundamente aninhado como dados de requisição pode causar a interrupção do processo Node.js devido a um RangeError.

Recommendations Atualizar para a versão 1.15.1 ou posterior. Atualizar para a versão 0.31.1 ou posterior.

Exploit

Correção

Allocation of Resources Without Limits

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-770

CWE-674

Identificadores relacionados

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42039

GHSA-62HF-57XW-28J9

OPENSUSE-SU-2026:11126-1

Produtos afetados

Axios

Referências · 311

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42039.json · Exploit
• https://github.com/axios/axios · Nota
• https://github.com/axios/axios/releases/tag/v1.15.1 · Nota
• https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC05413.json · Nota
• https://suse.com/security/cve/CVE-2026-1229 · Nota
• https://osv.dev/vulnerability/ghsa-fj3w-jwp8-x2g3 · Nota
• https://access.redhat.com/errata/RHSA-2026:24977 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:24853 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-27904 · Nota
• https://osv.dev/vulnerability/ghsa-3ppc-4f35-3m26 · Nota
• https://osv.dev/vulnerability/CVE-2026-44456 · Nota
• https://osv.dev/vulnerability/CVE-2026-4923 · Nota