CVE-2026-42039: Axios Unbounded Recursion in toFormData Leads to DoS via Deeply Nested Request Data

Background

Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. Axios supports promises and provides a rich set of features, including interceptors, automatic JSON data transformation, and the ability to cancel requests. However, a recent vulnerability has been identified in its toFormData function, which can lead to denial of service (DoS) attacks when processing deeply nested request data.

Vulnerability Detail

The vulnerability arises from the toFormData function, which recursively processes nested objects without a depth limit. This lack of restriction allows an attacker to craft a deeply nested payload, potentially exceeding 2000 levels deep. When such a payload is processed, it causes a RangeError due to exhaustion of the V8 call stack, leading to a crash of the Node.js process. This vulnerability can be exploited by remote, unauthenticated attackers who can influence the data passed to Axios, resulting in a denial of service in server-side applications that utilize Axios for handling requests.

npm install axios@1.20.0

Workaround

As a temporary workaround, you can implement a check in your application to limit the depth of nested objects before passing them to Axios. Here is an example of how you might do this:

function limitDepth(obj, maxDepth, currentDepth = 0) {
  if (currentDepth > maxDepth) {
    throw new Error('Maximum nesting depth exceeded');
  }
  for (const key in obj) {
    if (typeof obj[key] === 'object' && obj[key] !== null) {
      limitDepth(obj[key], maxDepth, currentDepth + 1);
    }
  }
}

// Usage

try {

limitDepth(req.body, 100);

// Limit to 100 levels

  await axios.post('https://upstream/api', req.body);
} catch (e) {
  console.error(e.message);
}

Conclusion

The vulnerability identified as CVE-2026-42039 in Axios poses a significant risk due to unbounded recursion in the toFormData function, which can lead to denial of service attacks. It is crucial to update to the patched version or implement workarounds to safeguard your applications.

See every vulnerability recorded for axios →

FAQ