Executive brief
Axios is a widely-used HTTP client library for JavaScript/Node.js applications. A flaw in its formToJSON function allows attackers to craft malicious form data with deeply nested field names that trigger uncontrolled recursion, crashing the server process with a stack overflow. This can disable services without authentication or any special privileges.
Technical details
The vulnerability resides in the buildPath() function within lib/helpers/formDataToJSON.js. This function recursively processes FormData field name segments extracted by parsePropPath(), which splits keys on bracket delimiters (e.g., a[x][y][z] → [a, x, y, z]). buildPath() recurses once per segment with no depth limit, so a field name with 15,000+ nested bracket pairs triggers 15,000+ call stack frames, exceeding V8's typical limit (~10,000–15,000 frames) and throwing RangeError: Maximum call stack size exceeded. The function is exposed publicly as axios.formToJSON() and invoked internally during request transformation when FormData is serialized as JSON (Content-Type: application/json). The complementary toFormData() function already enforces a configurable maxDepth guard (default 100) but formDataToJSON() lacks equivalent protection. Attack requires only network access and control over form field names; no authentication or user interaction is needed.
Affected products
- axios axios >=0.28.0, <0.33.0 and >=1.0.0, <1.18.0
Timeline
- 2026-07-06: disclosed: GHSA-pmv8-rq9r-6j72 published by axios security advisory
- 2026-08-01: advisory: GHSA-4ww2-rjh2-xpv9 (duplicate) published on OSV
- 2026-08-01: patched: Fixed in axios >=0.33.0 and >=1.18.0