EUVD-2026-51830
GHSA-4ww2-rjh2-xpv9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the required attack precondition (FormData with JSON serialisation and attacker-controlled field names); availability impact is Low as crashes are catchable.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
AnalysisAI
Uncontrolled recursion in axios's formDataToJSON helper allows remote, unauthenticated attackers to exhaust the JavaScript call stack and deny service to affected Node.js applications. axios versions 0.28.0 through 0.32.x and 1.0.0 through 1.17.x are affected wherever attacker-controlled FormData field names are deserialized with Content-Type: application/json, causing a RangeError that kills the request or terminates the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.3 and accurately represents the risk profile: network-reachable, no authentication required, but constrained by a specific attack precondition (AT:P) - the application must expose an endpoint that processes attacker-controlled FormData with JSON serialisation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits an HTTP request to a Node.js API endpoint that accepts FormData and forwards it through axios with Content-Type: application/json - for example, a file-upload proxy or a form-parsing middleware. The attacker crafts a field name consisting of thousands of bracket-delimited segments (e.g., a[b][c]...[z] repeated thousands of times). … |
| Remediation | The primary fix is upgrading axios to version 0.33.0 (for the 0.x line) or 1.18.0 (for the 1.x line), as documented in the GitHub Security Advisory GHSA-pmv8-rq9r-6j72 and implemented in upstream pull requests https://github.com/axios/axios/pull/11000 and https://github.com/axios/axios/pull/11001. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today