Axios form serializer maxDepth bypass via {} metatoken

Severity: high · CVSS 7.5 · Published 2026-08-01

Axios is a popular HTTP client library used by many web applications and services. When processing form data or URL parameters, axios can crash with a stack overflow error if an attacker provides specially crafted nested objects with keys ending in '{}'. This denial-of-service vulnerability primarily affects server-side applications that forward untrusted user input (like JSON request bodies) directly into axios, potentially causing application downtime or service disruption.

Technologies: Axios. Vendors: Axios.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 1 August 2026.
Which products and versions are affected?
Axios >=0.31.1, <0.33.0 and >=1.15.1, <1.18.0.
Is there a fix for This vulnerability?
A patch was published on 2026-07-06: Patches available in axios 0.33.0 and 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a bypass of the depth-limit guard introduced in GHSA-62hf-57xw-28j9. The root cause is in lib/helpers/toFormData.js's defaultVisitor function, which calls JSON.stringify() on values associated with top-level keys ending in '{}' before the recursive build() function can enforce the maxDepth check. Since JSON.stringify is a native V8 function with its own internal recursion, it can trigger a RangeError on deeply nested objects, bypassing axios's intended ERR_FORM_DATA_DEPTH_EXCEEDED error. The attack vector is network-based with no authentication required: any code path using axios for form serialization (multipart/form-data, application/x-www-form-urlencoded, or default parameter serialization) is vulnerable when processing attacker-controlled input. The payload is small (a few KB of nested {"x":{"x":{...}}} objects) and can stack-overflow a default Node.js process around depth ~3000. Patches are available in axios 0.33.0+ and 1.18.0+.

Affected products

  • axios axios >=0.31.1, <0.33.0 and >=1.15.1, <1.18.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory
  • 2026-07-06: patched: Patches available in axios 0.33.0 and 1.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.