Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.3, published 1 August 2026.

Which products and versions are affected?

Axios 0.28.0 to 0.32.x, 1.0.0 to 1.17.x.

Is there a fix for This vulnerability?

A patch was published on 2026: Patches available in versions 0.33.0 and 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Axios uncontrolled recursion in formDataToJSON denial of service

Severity: medium · CVSS 6.3 · Published 2026-08-01

Axios is a widely-used HTTP client library used by Node.js applications to make requests. The library contains a flaw in how it processes form data fields with excessively nested names, allowing an attacker to crash the server process with a specially crafted request. This denial-of-service vulnerability affects any application that sends untrusted user-submitted form data through Axios, potentially disrupting service availability for all users.

Technologies: Axios. Vendors: Axios.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.3, published 1 August 2026.
Which products and versions are affected?: Axios 0.28.0 to 0.32.x, 1.0.0 to 1.17.x.
Is there a fix for This vulnerability?: A patch was published on 2026: Patches available in versions 0.33.0 and 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the buildPath() function within lib/helpers/formDataToJSON.js, which recursively processes bracket-delimited segments in FormData key names without enforcing a maximum recursion depth. The parsePropPath() function extracts segments from keys like "a[x][x][x]" by splitting on brackets; a malicious key with 15,000+ nested bracket pairs results in 15,000+ recursive calls, exceeding the V8 JavaScript engine's default call stack limit (~10,000–15,000 frames) and throwing an unrecoverable RangeError. The vulnerability is reachable via two code paths: direct calls to the public axios.formToJSON() API and internal transformation when FormData is serialized to JSON (Content-Type: application/json). The inverse function toFormData already enforces a maxDepth limit; formDataToJSON lacks this guard. Patches are available in versions 0.33.0 and 1.18.0.

Affected products

axios axios 0.28.0 to 0.32.x, 1.0.0 to 1.17.x

Timeline

2026-07-06: disclosed: Original advisory GHSA-pmv8-rq9r-6j72 published
2026-08-01: advisory: Duplicate advisory GHSA-4ww2-rjh2-xpv9 published
2026: patched: Patches available in versions 0.33.0 and 1.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.