# Axios form serializer maxDepth bypass via {} metatoken

Source: https://junglewise.ai/threats/axios-form-serializer-maxdepth-bypass-via-metatoken-a3285ce5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-08-01

Axios is a popular HTTP client library used by many web applications and services. When processing form data or URL parameters, axios can crash with a stack overflow error if an attacker provides specially crafted nested objects with keys ending in '{}'. This denial-of-service vulnerability primarily affects server-side applications that forward untrusted user input (like JSON request bodies) directly into axios, potentially causing application downtime or service disruption.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 1 August 2026.

**Which products and versions are affected?** Axios >=0.31.1, <0.33.0 and >=1.15.1, <1.18.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-06: Patches available in axios 0.33.0 and 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a bypass of the depth-limit guard introduced in GHSA-62hf-57xw-28j9. The root cause is in lib/helpers/toFormData.js's defaultVisitor function, which calls JSON.stringify() on values associated with top-level keys ending in '{}' before the recursive build() function can enforce the maxDepth check. Since JSON.stringify is a native V8 function with its own internal recursion, it can trigger a RangeError on deeply nested objects, bypassing axios's intended ERR_FORM_DATA_DEPTH_EXCEEDED error. The attack vector is network-based with no authentication required: any code path using axios for form serialization (multipart/form-data, application/x-www-form-urlencoded, or default parameter serialization) is vulnerable when processing attacker-controlled input. The payload is small (a few KB of nested {"x":{"x":{...}}} objects) and can stack-overflow a default Node.js process around depth ~3000. Patches are available in axios 0.33.0+ and 1.18.0+.

## Affected products

- axios axios >=0.31.1, <0.33.0 and >=1.15.1, <1.18.0

## Timeline

- 2026-08-01: disclosed
- 2026-08-01: advisory
- 2026-07-06: patched: Patches available in axios 0.33.0 and 1.18.0

## References

- [https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23](https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23)
- [https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass](https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)