EUVD-2026-51812
GHSA-3mcp-22mf-vrw3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the dual precondition of controlling both the '{}'-suffixed key name and a deeply nested value through the application's data flow; availability impact is limited to the affected request path with no C/I impact confirmed.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 547 npm packages depend on axios (26 direct, 523 indirect)
Ecosystem-wide dependent count for version 0.31.1.
DescriptionCVE.org
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
AnalysisAI
Denial of service in the axios HTTP client library allows remote attackers to crash server-side request paths by exploiting an incomplete depth-limit bypass introduced as a residual flaw after the prior fix for GHSA-62hf-57xw-28j9. Affected are npm axios versions 0.31.1 through 0.32.x and 1.15.1 through 1.17.x; server-side Node.js applications that accept user-controlled input and pass it to axios form or parameter serialization are the primary concern. No public exploit code has been identified and no CISA KEV listing exists, but the attack mechanism is fully documented in the vendor's GitHub security advisory, materially lowering the exploitation bar for motivated actors.
Technical ContextAI
axios (cpe:2.3:a:axios:axios) is a promise-based HTTP client for Node.js and browsers and is among the most downloaded packages in the npm ecosystem. The vulnerability is classified as CWE-674 (Uncontrolled Recursion) and resides in lib/helpers/toFormData.js. The function defaultVisitor() contains a special branch for top-level object keys ending in '{}': before recursive traversal and before the formSerializer.maxDepth guard can fire, it calls JSON.stringify() directly on the value. Supplying an arbitrarily deep nested object as that value triggers a native JavaScript RangeError: Maximum call stack size exceeded rather than the intended AxiosError depth guard. The same vulnerable path is exercised via toURLEncodedForm.js, AxiosURLSearchParams.js, and the default request transforms in lib/defaults/index.js for multipart/form-data and application/x-www-form-urlencoded content types.
RemediationAI
Upgrade to axios 0.33.0 (for 0.x deployments) or axios 1.18.0 (for 1.x deployments); these releases contain the upstream fixes from GitHub PRs #11000 and #11001. The full vendor advisory is at https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23. If immediate upgrade is not possible, validate and reject any user-supplied object keys ending in '{}' before they reach the axios data or params arguments - this removes the triggering condition at the application boundary. Setting formSerializer.metaTokens: false is explicitly NOT a workaround: it changes only the emitted key name, while the vulnerable JSON.stringify() call is still executed on the value. Applications that pre-construct FormData or URLSearchParams objects and pass them to axios without relying on axios's internal toFormData helper are not affected and require no remediation action.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today