Axios uncontrolled recursion in formDataToJSON

Executive brief

Axios, a popular JavaScript library for making web requests, is vulnerable to a denial-of-service attack. By sending a specially crafted web form with deeply nested field names, an attacker can cause the application to crash or stop responding. This affects any application that uses Axios to convert form data into JSON format, potentially leading to service outages.

Technical details

The vulnerability exists in the `buildPath` function within `lib/helpers/formDataToJSON.js`. When Axios serializes `FormData` with a `Content-Type` of `application/json`, it recursively processes bracket-delimited path segments (e.g., `a[b][c]`) without enforcing a maximum depth. An attacker can provide a `FormData` object with thousands of nested segments, causing a `RangeError: Maximum call stack size exceeded`. In Node.js environments, this often results in process termination. The issue is fixed in versions 0.33.0 and 1.18.0 by implementing depth limits similar to those already present in the `toFormData` helper.

Affected products

• axios axios >= 0.28.0, < 0.33.0; >= 1.0.0, < 1.18.0

Timeline

• 2026-07-06: disclosed
• 2026-07-20: advisory

References

• https://api.github.com/users/sam-caldwell
• https://github.com/sam-caldwell
• https://api.github.com/users/sam-caldwell/gists%7B/gist_id%7D
• https://api.github.com/users/sam-caldwell/repos
• https://avatars.githubusercontent.com/u/24298795?v=4
• https://api.github.com/users/sam-caldwell/events%7B/privacy%7D