Axios denial of service via excessive recursion in formDataToJSON

Executive brief

Axios, a popular library for making web requests, contains a flaw that can be used to crash applications. By sending specially crafted form data with deeply nested field names, an attacker can cause the application to run out of memory or stop responding. This primarily affects servers that process user-submitted forms and convert them into JSON format.

Technical details

The vulnerability exists in the `formDataToJSON` helper, specifically within the nested `buildPath` function in `lib/helpers/formDataToJSON.js`. When parsing `FormData` field names that contain many nested bracket segments (e.g., 'a[b][c]...'), the function recursively calls itself for each segment without enforcing a maximum depth. An attacker can provide a field name with thousands of segments to exhaust the JavaScript call stack, triggering a `RangeError`. This can lead to request failures or process termination in Node.js environments. The issue is patched in versions 0.33.0 and 1.18.0.

Affected products

• Axios Axios >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0

Timeline

• 2026-07-06: disclosed
• 2026-07-20: advisory

References

• https://api.github.com/users/alcls01111
• https://github.com/alcls01111
• https://api.github.com/users/alcls01111/gists%7B/gist_id%7D
• https://api.github.com/users/alcls01111/repos
• https://avatars.githubusercontent.com/u/57210489?v=4
• https://api.github.com/users/alcls01111/events%7B/privacy%7D