PT-2026-67293 · Npm · Axios
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
axios versions 0.28.0 and later
Description
Uncontrolled recursion exists in the
formDataToJSON function when processing FormData field names containing deeply nested bracket segments. An attacker can provide FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack, triggering a RangeError. This leads to request failure or process termination in applications that do not handle the exception, resulting in a denial of service. This issue affects the axios.formToJSON(formData) API, the formToJSON import, the lib/helpers/formDataToJSON.js file, and the default transformRequest when FormData is sent with an application/json content type. The vulnerability is triggered via the buildPath() function, which recursively processes path segments without enforcing a maximum depth.Recommendations
For axios versions 0.28.0 and later, validate
FormData field names to reject keys whose nesting depth exceeds the expected schema before calling formToJSON() or sending FormData with Content-Type: application/json.
For axios requests carrying untrusted FormData, avoid setting Content-Type: application/json to bypass the formDataToJSON() process.
As a temporary mitigation, implement error handling to catch the resulting RangeError to prevent full process termination.Exploit
Fix
Resource Exhaustion
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Axios