← CVE Intelligence

CVE-2026-42039

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data PUBLISHED

Description (CNA)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

Affected (CNA)

Vendor / productVersions
axios / axiosaffected >= 1.0.0, < 1.15.1; affected < 0.31.1

CWE

CWE-674

References

ADP enrichment

CISA-ADP

No English description supplied.

redhat-SADP

A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.