Executive brief
Axios is a popular HTTP client library used by many web applications and services. When processing form data or URL parameters, axios can crash with a stack overflow error if an attacker provides specially crafted nested objects with keys ending in '{}'. This denial-of-service vulnerability primarily affects server-side applications that forward untrusted user input (like JSON request bodies) directly into axios, potentially causing application downtime or service disruption.
Technical details
This vulnerability is a bypass of the depth-limit guard introduced in GHSA-62hf-57xw-28j9. The root cause is in lib/helpers/toFormData.js's defaultVisitor function, which calls JSON.stringify() on values associated with top-level keys ending in '{}' before the recursive build() function can enforce the maxDepth check. Since JSON.stringify is a native V8 function with its own internal recursion, it can trigger a RangeError on deeply nested objects, bypassing axios's intended ERR_FORM_DATA_DEPTH_EXCEEDED error. The attack vector is network-based with no authentication required: any code path using axios for form serialization (multipart/form-data, application/x-www-form-urlencoded, or default parameter serialization) is vulnerable when processing attacker-controlled input. The payload is small (a few KB of nested {"x":{"x":{...}}} objects) and can stack-overflow a default Node.js process around depth ~3000. Patches are available in axios 0.33.0+ and 1.18.0+.
Affected products
- axios axios >=0.31.1, <0.33.0 and >=1.15.1, <1.18.0
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
- 2026-07-06: patched: Patches available in axios 0.33.0 and 1.18.0