Junglewise Threat Intelligence

CVE-2026-42039: Axios unbounded recursion denial of service in toFormData

CVE-2026-42039 · Severity: high · CVSS 7.5 · Published 2026-04-24

Technologies: Axios. Vendors: Axios.

Executive brief

Axios is a widely used library for making web requests in Node.js and browser applications. A flaw in how it handles complex, nested data structures allows an attacker to send a specially crafted request that causes the application to crash. This can lead to a denial-of-service (DoS) condition, potentially taking down the entire server or specific application features.

Technical details

The vulnerability exists in the 'toFormData' helper (specifically lib/helpers/toFormData.js), which is used to serialize request bodies and URL parameters. The 'build' function within this helper recursively traverses nested objects and arrays without a depth limit. An attacker can provide a deeply nested object (e.g., 2000+ levels deep) that exhausts the V8 engine's call stack, triggering a synchronous RangeError. In Node.js environments, this error can propagate and crash the request handler or the entire process. The issue is fixed in versions 1.15.1 and 0.31.1 by implementing recursion depth bounding.

Affected products

  • Axios Axios < 1.15.1, < 0.31.1

Timeline

  • 2026-04-24: advisory: GitHub Security Advisory published
  • 2026-04-24: patched: Fixed in versions 1.15.1 and 0.31.1
  • 2026-04-24: disclosed

References

Related threats