axios EUVD-2026-51812

All of the following conditions must hold simultaneously: (1) the target application passes user-controlled object data to axios as the data or params option for a multipart/form-data, application/x-www-form-urlencoded, or default parameter-serialized request; (2) the attacker can influence a top-level object key so that it ends in '{}'; and (3) the attacker can supply a sufficiently deeply nested object as the corresponding value. Applications that pre-construct FormData or URLSearchParams objects and pass them to axios directly are not affected. Custom paramsSerializer.serialize implementations that do not internally call axios toFormData are not affected. Deeply nested values whose keys do NOT end in '{}' still hit the intended AxiosError guard and are not exploitable via this specific bypass. Browser impact is confined to the affected tab or page context and does not affect other origins or sessions.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) reflects a network-reachable, unauthenticated denial-of-service with limited availability impact. Real-world risk is conditional: exploitation requires the target application to route user-supplied object keys directly into axios serialization - a design pattern common in proxy and API-gateway patterns but not universal. No EPSS score was supplied in the source data, and there is no CISA KEV listing, so exploitation probability cannot be quantified beyond the described attack mechanism. The vendor CVSS 4.0 vector sets AT:N (no special attack requirements), which reflects the ease of exploitation once the precondition of key-name control is met; this analyst independently assesses AT:P given that the application architecture must expose user-controlled key names to the axios serialization path. The impact is availability-only - confidentiality and integrity are confirmed unaffected by the vendor advisory. Browser impact is confined to the affected tab or page context, making server-side Node.js applications the primary risk surface.

An attacker sends an HTTP POST to a Node.js API that accepts JSON body parameters and forwards them to a downstream service via axios using multipart/form-data encoding. The attacker includes a field with the key name 'config{}' and a deeply nested object as its value; when axios processes the request, defaultVisitor() calls JSON.stringify() on the nested payload before the depth guard runs, triggering RangeError: Maximum call stack size exceeded and crashing the request handler. No public exploit code has been identified, but the precise code path and bypass condition are fully described in the vendor advisory.