EUVD-2026-51812
GHSA-3mcp-22mf-vrw3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the dual precondition of controlling both the '{}'-suffixed key name and a deeply nested value through the application's data flow; availability impact is limited to the affected request path with no C/I impact confirmed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
AnalysisAI
Denial of service in the axios HTTP client library allows remote attackers to crash server-side request paths by exploiting an incomplete depth-limit bypass introduced as a residual flaw after the prior fix for GHSA-62hf-57xw-28j9. Affected are npm axios versions 0.31.1 through 0.32.x and 1.15.1 through 1.17.x; server-side Node.js applications that accept user-controlled input and pass it to axios form or parameter serialization are the primary concern. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following conditions must hold simultaneously: (1) the target application passes user-controlled object data to axios as the data or params option for a multipart/form-data, application/x-www-form-urlencoded, or default parameter-serialized request; (2) the attacker can influence a top-level object key so that it ends in '{}'; and (3) the attacker can supply a sufficiently deeply nested object as the corresponding value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) reflects a network-reachable, unauthenticated denial-of-service with limited availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends an HTTP POST to a Node.js API that accepts JSON body parameters and forwards them to a downstream service via axios using multipart/form-data encoding. The attacker includes a field with the key name 'config{}' and a deeply nested object as its value; when axios processes the request, defaultVisitor() calls JSON.stringify() on the nested payload before the depth guard runs, triggering RangeError: Maximum call stack size exceeded and crashing the request handler. … |
| Remediation | Upgrade to axios 0.33.0 (for 0.x deployments) or axios 1.18.0 (for 1.x deployments); these releases contain the upstream fixes from GitHub PRs #11000 and #11001. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today