Executive brief
Axios, a popular JavaScript HTTP client library, contains a vulnerability in its FormData-to-JSON conversion function that allows attackers to craft form field names with deeply nested brackets to exhaust the JavaScript call stack. When an application processes untrusted form data through axios' JSON serialization (either explicitly via formToJSON() or implicitly through the default request transform with JSON content-type), a malicious field name can trigger a RangeError that crashes the request or terminates the process entirely.
Technical details
The vulnerability exists in lib/helpers/formDataToJSON.js, where the buildPath() function recursively processes form field name path segments without enforcing a maximum recursion depth. An attacker can supply a FormData field name containing thousands of nested bracket segments (e.g., "a[x][x][x]..." repeated thousands of times), causing the recursive buildPath() calls to exhaust the JavaScript call stack and throw RangeError: Maximum call stack size exceeded. The vulnerable code path is reached when (1) formToJSON() is called directly on untrusted FormData, or (2) FormData is passed to axios.post/request with Content-Type: application/json header, triggering the default request transform. Axios already enforces a maxDepth guard in the inverse toFormData() serializer; formDataToJSON() lacks equivalent protection. The vulnerability affects versions 0.28.0 through <1.18.0 and does not require authentication or user interaction to trigger.
Affected products
- Axios axios >=0.28.0, <1.18.0
Timeline
- 2026-08-01: disclosed: GHSA-fq2j-3j99-rx65 published as duplicate of GHSA-42h9-826w-cgv3
- 2026-09-01: withdrawn: Advisory withdrawn as duplicate of GHSA-42h9-826w-cgv3
- 2026-07-06: patched: Original advisory GHSA-42h9-826w-cgv3 published; fix available in 1.18.0+