Denial of Service Vulnerability in Axios: Deep formToJSON Key Recursion
Summary
GHSA-4ww2-rjh2-xpv9: Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service. Affects axios versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from node.js or XMLHttpRequests from the browser. It provides a simple API for handling requests and responses, supports promises, and can handle JSON data easily. However, certain versions of Axios are vulnerable to a denial of service attack due to uncontrolled recursion in the formDataToJSON function, which can be exploited when processing malicious FormData.
Vulnerability Detail
The vulnerability arises in Axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0. It allows an attacker to pass FormData field names that contain thousands of nested bracket-delimited segments. This leads to unbounded recursion in the buildPath function, resulting in a RangeError: Maximum call stack size exceeded. Consequently, this can cause denial of service for the affected request or even terminate the application process if proper error handling is not implemented.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, update Axios to a patched version. You can do this by running the following command in your project directory: npm install axios@^1.18.0. This will ensure that you are using a version of Axios that does not contain this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize FormData field names before they are processed by Axios. Ensure that field names do not contain excessive nested segments or are limited to a reasonable depth.
Conclusion
The uncontrolled recursion vulnerability in Axios can lead to significant issues, including denial of service. It is crucial to update to the latest version to mitigate this risk. Implementing input validation can serve as a temporary measure while you work on updating your dependencies.
See every vulnerability recorded for axios →
FAQ
Axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 are affected.
The vulnerability can lead to denial of service, causing requests to fail or the application to crash due to stack overflow.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, you can implement input validation to sanitize FormData field names to prevent excessive nesting.
Vulert is a tool that monitors open-source vulnerabilities in your software using just package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for axios.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.