Executive brief
Axios is a popular HTTP client library used in Node.js and browser applications. A vulnerability in its formToJSON function allows attackers to craft malicious form data with deeply nested field names that exhaust the JavaScript call stack, causing the application to crash. An attacker with control over form field names can mount a denial-of-service attack that terminates the entire process.
Technical details
The vulnerability is an uncontrolled recursion flaw in the formDataToJSON helper (lib/helpers/formDataToJSON.js), specifically in the buildPath() function. This function recursively processes FormData field names that contain bracket-delimited segments (e.g., a[x][x][x]) without enforcing a maximum recursion depth. An attacker can craft a field name with thousands of nested bracket segments to trigger a RangeError: Maximum call stack size exceeded. The vulnerability affects applications that either call axios.formToJSON() directly on untrusted FormData or send untrusted FormData via axios requests with Content-Type: application/json, which triggers automatic JSON serialization. The inverse function toFormData() already implements a maxDepth guard; formDataToJSON lacks this protection. Patches are available in versions 0.33.0 and 1.18.0 or later.
Affected products
- Axios Axios >=0.28.0, <0.33.0; >=1.0.0, <1.18.0
Timeline
- 2026-07-20: disclosed
- 2026-07-06: patched: patches released in versions 0.33.0 and 1.18.0