GHSA-42h9-826w-cgv3

Medium

Published: —Translated: 03/08/2026(UTC)NVD NIST

Summary

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Risk Assessment

An attacker can cause stack exhaustion, leading to denial of service (DoS) or potentially other impacts.

Recommendation

It is recommended to upgrade axios to a version that includes a fix limiting recursion in formDataToJSON.

Original NVD description (English source)

## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type. Applications are affected