Skip to main content

Axios CVE-2026-42039

| EUVDEUVD-2026-25605 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-04-24 GitHub_M GHSA-62hf-57xw-28j9
Denial Of Service Node.js Axios
6.9
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts JSON payload with deep nesting
  2. Delivery
    Sends HTTP request to vulnerable Axios endpoint
  3. Exploit
    Axios toFormData parses nested object
  4. Execution
    Recursive traversal exceeds call stack
  5. Persist
    Node.js process crashes with RangeError
  6. Impact
    Service unavailable to legitimate clients

Vulnerability Assessment

Weakness
CWE
CWE-674
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
Exploitation Conditions

Exploitation requires that the application explicitly calls Axios with request data containing nested objects passed through toFormData conversion. The vulnerability is triggered during Axios request preparation, specifically when: (1) the application uses Axios.post(), Axios.put(), or similar methods with data parameter, (2) the request data contains nested objects (JSON payloads), and (3) Axios internally invokes toFormData to serialize the nested structure. Exploitation does NOT require authentication, special privileges, or non-default configuration - it exploits the default behavior of toFormData with deeply nested structures. However, the attack is limited to Node.js server-side deployments; browser-based usage triggers the same code path but typically only freezes the client tab rather than crashing the entire Node.js process. Additionally, applications that pre-validate request depth or that do not use toFormData (e.g., applications that send JSON without form encoding) are not affected.
Impact

CVSS 6.9 with AV:N/AC:L/PR:N/UI:N indicates network-accessible remote unauthenticated attack with no special complexity or user interaction required. However, the scope and impact assessment requires careful analysis: CVSS impact vector shows VA:L (availability low) with no confidentiality or integrity impact, which aligns with the denial of service nature - the attack crashes the process but does not leak data or enable code execution. The lack of confirmed EPSS score, KEV status, or public exploit code suggests this is a known vulnerability to researchers but not yet widely exploited in production. Real-world risk is moderate: any Node.js application using Axios versions before 1.15.1/0.31.1 that accepts user input and passes it through toFormData without pre-validation is vulnerable. However, exploitation requires the application to explicitly use toFormData with untrusted nested data, which is not uncommon in APIs that accept JSON payloads and convert them to form submissions. The attack is trivially easy to execute - a single malformed HTTP request with deeply nested JSON causes instant process crash - but only affects availability, not confidentiality or integrity. This is a moderate-priority fix for production Node.js services but lower risk for browser-based deployments where the impact is a single client-side process freeze, not a server crash.
Exploit ScenarioDerived

An attacker sends an HTTP POST request to a Node.js application using Axios, with a JSON payload containing an object nested 10,000 levels deep (e.g., {a: {b: {c: {...}}}). When the application receives this request and passes the parsed JSON object to Axios toFormData during request preparation (common in APIs that proxy form submissions), the recursive function enters an infinite call stack, causing the Node.js process to crash with RangeError: Maximum call stack size exceeded. The attacker can repeat this attack against multiple requests to repeatedly crash the service.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 24, 2026

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to crash Node.js processes by sending requests with deeply nested object structures that trigger unbounded recursion in the toFormData function. The vulnerability affects both browser and Node.js environments but is exploitable in server-side Node.js deployments where attacker-controlled data is passed to toFormData without depth validation.

RemediationAI

Upgrade Axios to version 1.15.1 or later for the 1.x branch, or version 0.31.1 or later for the 0.x branch. These versions include the fix that adds depth limits and cycle detection to the toFormData recursive traversal. In package.json, update the axios dependency to >=1.15.1 or >=0.31.1 depending on your version line, then run npm install or npm update. For applications that cannot immediately upgrade, implement request-level validation to reject deeply nested objects before passing them to Axios toFormData - specifically, validate that request body object nesting depth does not exceed 10-20 levels (adjust threshold based on legitimate use cases). This compensating control requires custom middleware but prevents the crash without code changes. Additionally, consider using native Node.js http.request() without Axios for form submissions that do not require promise-based APIs, though this is a larger refactor. Consult the GitHub advisory at https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9 for detailed upgrade instructions and confirmation of patch completeness.

Affected VersionsENISA

axios 1.0.0, < 1.15.1
axios < 0.31.1

Affected Packages

npm axios fix: 0.31.1, 1.15.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is a promise-based HTTP client library used in both browser and Node.js environments. The vulnerability resides in the toFormData utility function, which recursively processes nested objects when converting request data to FormData format. The root cause is CWE-674 (uncontrolled recursion), where the recursive traversal has no depth limit or cycle detection. When an attacker provides deeply nested object structures as request body data, the recursive call stack grows unbounded until the Node.js process exhausts available memory and crashes with a RangeError. This occurs during request preparation before transmission, making it a denial of service condition triggered by the library's own data processing logic rather than server-side handling.

Know when Axios gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
Patch released
Apr 27, 2026 - 19:50 nvd
Patch available
Patch available
Apr 24, 2026 - 20:17 EUVD
CVSS changed
Apr 24, 2026 - 18:22 NVD
6.9 (MEDIUM)
CVE Published
Apr 24, 2026 - 18:01 nvd
MEDIUM 6.9

DescriptionCVE.org

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

54
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Axios

View all
CVE-2026-42043 CRITICAL POC
10.0 Apr 24

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42041 MEDIUM POC
6.5 Apr 24

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error

CVE-2023-45857 MEDIUM POC
6.5 Nov 08

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:14937 ADVISORY https://access.redhat.com/errata/RHSA-2026:16476 ADVISORY https://access.redhat.com/errata/RHSA-2026:16532 ADVISORY https://access.redhat.com/errata/RHSA-2026:16534 ADVISORY https://access.redhat.com/errata/RHSA-2026:16535 ADVISORY https://access.redhat.com/errata/RHSA-2026:16542 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42039 ADVISORY https://vuldb.com/vuln/359508 REF https://access.redhat.com/errata/RHSA-2026:16874 REF https://access.redhat.com/errata/RHSA-2026:17468 REF https://access.redhat.com/errata/RHSA-2026:17474 REF https://access.redhat.com/errata/RHSA-2026:17657 REF https://access.redhat.com/errata/RHSA-2026:17699 REF https://access.redhat.com/errata/RHSA-2026:19109 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:21017 REF https://access.redhat.com/errata/RHSA-2026:21338 REF https://access.redhat.com/errata/RHSA-2026:21772 REF https://access.redhat.com/errata/RHSA-2026:22465 REF https://access.redhat.com/errata/RHSA-2026:22619 REF https://access.redhat.com/errata/RHSA-2026:22629 REF https://access.redhat.com/errata/RHSA-2026:22840 REF https://access.redhat.com/errata/RHSA-2026:23361 REF https://access.redhat.com/errata/RHSA-2026:24473 REF https://access.redhat.com/errata/RHSA-2026:24536 REF https://access.redhat.com/errata/RHSA-2026:24539 REF https://access.redhat.com/errata/RHSA-2026:24853 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:25041 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:25271 REF https://access.redhat.com/errata/RHSA-2026:25273 REF https://access.redhat.com/errata/RHSA-2026:26214 REF https://access.redhat.com/errata/RHSA-2026:26225 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:48085 REF https://access.redhat.com/errata/RHSA-2026:48670 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/security/cve/CVE-2026-42039 REF https://bugzilla.redhat.com/show_bug.cgi?id=2461630 REF https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy