Executive brief
Axios, a popular JavaScript HTTP client library, contains a vulnerability in its form data serialization that allows attackers to cause denial of service by crafting deeply nested objects with specially crafted keys. Applications that accept user-controlled input and pass it to Axios for form or parameter serialization can crash with a stack overflow error, disrupting service availability for affected requests or potentially the entire application in server environments.
Technical details
The vulnerability is a recursive depth-bypass in lib/helpers/toFormData.js. The defaultVisitor function has a top-level shortcut that immediately calls JSON.stringify(value) on any top-level key ending in '{}', before the build() function's maxDepth guard can inspect the nested structure. Since JSON.stringify is a native, recursive function, deeply nested objects cause a stack overflow (RangeError: Maximum call stack size exceeded) before Axios can emit its intended AxiosError. The attack requires attacker control over object keys and nested values passed to Axios form data, URL-encoded form bodies, or query parameters. The metaTokens option does not mitigate this; it only controls the key name, not the value stringification. Server-side applications are at highest risk when they forward untrusted user input (e.g., req.body, req.query) into Axios serialization. Patches are available in Axios versions ≥0.33.0 and ≥1.18.0.
Affected products
- axios axios >=0.31.1, <0.33.0; >=1.15.1, <1.18.0
Timeline
- 2026-07-06: disclosed: Original advisory GHSA-hcpx-6fm6-wx23 published
- 2026-08-01: advisory: Duplicate advisory GHSA-3mcp-22mf-vrw3 published; withdrawn 2026-09-08
- 2026: patched: Fixed in Axios 0.33.0 and 1.18.0