PT-2026-35049 · Npm · Axios

Fg0X0 · Publicado 2026-04-24 · Atualizado 2026-05-18 · CVE-2026-42039

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Axios versões anteriores a 1.15.1 Axios versões anteriores a 0.31.1

Description A função toFormData processa objetos aninhados recursivamente sem limite de profundidade. Consequentemente, o fornecimento de um valor profundamente aninhado como dados de requisição pode causar a interrupção do processo Node.js devido a um RangeError.

Recommendations Atualizar para a versão 1.15.1 ou posterior. Atualizar para a versão 0.31.1 ou posterior.

Exploit

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42039

GHSA-62HF-57XW-28J9

Produtos afetados

Axios

Referências · 215

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9 · Exploit
• https://github.com/axios/axios · Nota
• https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f · Nota
• https://github.com/axios/axios/releases/tag/v1.15.1 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC05413.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://osv.dev/vulnerability/ghsa-39q2-94rc-95cp · Nota
• https://osv.dev/vulnerability/CVE-2026-33937 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-29085 · Nota
• https://osv.dev/vulnerability/ghsa-ppp5-5v6c-4jwp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-2w6w-674q-4c4q · Nota
• https://osv.dev/vulnerability/CVE-2026-42041 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Nota de Segurança