GHSA-pmv8-rq9r-6j72
MediumSummary
Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.
Risk Assessment
An attacker can cause application crash via stack exhaustion, leading to denial of service (DoS).
Recommendation
It is recommended to upgrade axios to a version that includes a fix limiting recursion in formDataToJSON.
Original NVD description (English source)
## Summary Axios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`. If an application passes attacker-controlled `FormData` field na