DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-42H9-826W-CGV3: GHSA-42H9-826W-CGV3: Denial of Service via Uncontrolled Recursion in Axios formDataToJSON

#security #cve #cybersecurity #ghsa

GHSA-42H9-826W-CGV3: Denial of Service via Uncontrolled Recursion in Axios formDataToJSON

Vulnerability ID: GHSA-42H9-826W-CGV3
CVSS Score: 7.5
Published: 2026-07-20

An uncontrolled recursion vulnerability (CWE-674) in the Axios HTTP library allows remote attackers to cause a Denial of Service (DoS) by submitting form-data with deeply nested property keys. When Axios converts this form-data to JSON, it recursively traverses the path segments without establishing a maximum depth limit, resulting in a maximum call stack size exhaustion and a hard process crash in Node.js environments.

TL;DR

Uncontrolled recursion in Axios's formDataToJSON parser allows unauthenticated remote attackers to crash Node.js servers via a single crafted request with deeply nested form keys.

Technical Details

  • CWE ID: CWE-674 (Uncontrolled Recursion)
  • Attack Vector: Network (Unauthenticated HTTP POST/PUT requests)
  • CVSS v3.1 Severity Score: 7.5 (High)
  • Impact Type: Complete Denial of Service (Process Crash)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • Node.js backend servers using Axios to serialize or parse FormData JSON conversion payloads
  • Server-Side Rendering (SSR) frameworks forwarding client multipart payloads via Axios
  • Client-side browser applications processing untrusted nested inputs through Axios payload converters
  • axios: < 0.33.0 (Fixed in: 0.33.0)
  • axios: >= 1.0.0, < 1.18.0 (Fixed in: 1.18.0)

Code Analysis

Commit: 32fc489

Fix: Enforce strict depth ceiling limit during FormData to JSON conversion in v1.x branch

Modified lib/helpers/formDataToJSON.js and lib/helpers/toFormData.js to enforce MAX_DEPTH of 100.
Enter fullscreen mode Exit fullscreen mode

Commit: 1417285

Fix: Enforce strict depth ceiling limit during FormData to JSON conversion in v0.x branch

Ported depth limits to v0.x legacy parser in lib/helpers/formDataToJSON.js.
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade Axios to a patched version (>= 0.33.0 or >= 1.18.0)
  • Implement incoming request parameter validation middleware to drop requests with excessive depth
  • Deploy WAF rules to detect and reject parameters with high bracket density

Remediation Steps:

  1. Identify all instances of Axios in package.json and lockfile configurations.
  2. Upgrade Axios using npm update axios or yarn upgrade axios to version 1.18.0 (or 0.33.0 for 0.x configurations).
  3. Validate the upgrade by testing multipart/form-data deserialization workflows.
  4. Verify that process crash alerts are configured on PM2 or systemd to monitor node process lifecycles.

References

Read the full report for GHSA-42H9-826W-CGV3 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)