GHSA-4WW2-RJH2-XPV9: axios Npm
Vulnerability summary
GHSA-4WW2-RJH2-XPV9 is a medium (CVSS 6.3) vulnerability in axios Npm.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 01-08-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pmv8-rq9r-6j72. This link is maintained to preserve external references. ## Original Description axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Npm1 product
- axios≥ 1.0.0 (No fix recorded)
1 vendor · 1 product
