Axios uncontrolled recursion in form serializer via metatoken bypass

Executive brief

Axios is a popular library used by applications to make web requests. A flaw in how it handles complex data structures allows an attacker to send specially crafted input that crashes the application. This results in a denial of service, potentially taking down server-side processes that process user-provided data.

Technical details

The vulnerability exists in the `toFormData` helper and related serialization paths. When a top-level object key ends with the '{}' metatoken, Axios invokes the native `JSON.stringify()` on the associated value before the `maxDepth` guard can be applied. An attacker can provide a deeply nested object that causes a stack overflow (RangeError) in the JavaScript engine's stringifier. This bypasses the intended `ERR_FORM_DATA_DEPTH_EXCEEDED` error handling and synchronously crashes the request path or the entire Node.js process. The issue was fixed in versions 0.33.0 and 1.18.0.

Affected products

• axios axios >= 0.31.1, < 0.33.0
• axios axios >= 1.15.1, < 1.18.0

Timeline

• 2026-07-06: advisory: GitHub Advisory GHSA-hcpx-6fm6-wx23 published
• 2026-07-20: disclosed

References

• https://api.github.com/users/fg0x0
• https://github.com/fg0x0
• https://api.github.com/users/fg0x0/gists%7B/gist_id%7D
• https://api.github.com/users/fg0x0/repos
• https://avatars.githubusercontent.com/u/35772301?v=4
• https://api.github.com/users/fg0x0/events%7B/privacy%7D