PT-2026-67292 · Npm · Axios
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
axios versions 0.28.0 through 0.32.x
axios versions 1.0.0 through 1.17.x
Description
Uncontrolled recursion exists in the
formDataToJSON function, which is exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json. If an application processes attacker-controlled FormData field names, a field name containing thousands of nested bracket-delimited segments can trigger unbounded recursion in the buildPath() function. This exhausts the JavaScript call stack, resulting in a RangeError: Maximum call stack size exceeded, which leads to a denial of service for the request or complete process termination in applications lacking appropriate error handling.Recommendations
Update axios to version 0.33.0 or later.
Update axios to version 1.18.0 or later.
As a temporary workaround, reject or normalize untrusted form field names before calling
axios.formToJSON().
Avoid sending untrusted FormData through axios as JSON unless conversion is strictly required.
Implement error handling to catch exceptions around formToJSON() or axios requests that transform untrusted FormData.Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Axios