Axios excessive recursion in formDataToJSON denial of service

Severity: high · CVSS 7.5 · Published 2026-08-01

Axios is a popular HTTP client library used in web applications to make network requests. A flaw in how Axios processes form data with deeply nested field names can be exploited by attackers to crash applications by triggering stack overflow errors. This affects server applications that accept untrusted form input and convert it to JSON format, potentially allowing remote denial of service attacks.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 1 August 2026.
Which products and versions are affected?
axios axios >=0.28.0, <1.18.0.
Is there a fix for This vulnerability?
A patch was published on 2026-08-01: Fixed in version 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The formDataToJSON helper in lib/helpers/formDataToJSON.js recursively parses FormData field names into path segments without enforcing a maximum recursion depth. The buildPath() function calls itself recursively once for each bracket-delimited path segment in a field name (e.g., "a[x][x][x]" creates three recursive calls). An attacker-controlled FormData with field names containing thousands of nested brackets can exhaust the V8 JavaScript call stack and throw "RangeError: Maximum call stack size exceeded". The vulnerable code path is reached when: (1) formToJSON() is called directly on attacker-controlled FormData, or (2) axios requests FormData with Content-Type: application/json, triggering the default transformRequest. Axios already applies a maxDepth guard (default 100) to the inverse toFormData() serializer, but formDataToJSON() lacks equivalent protection. The fix involves adding a maximum recursion depth check similar to toFormData().

Affected products

  • axios axios >=0.28.0, <1.18.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: patched: Fixed in version 1.18.0
  • 2026-09-01: advisory: Advisory withdrawn as duplicate of GHSA-42h9-826w-cgv3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.