GHSA-pmv8-rq9r-6j72 — Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Affected: npm: axios

## Summary

Axios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.

If an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropriate error handling, process termination.

## Impact

Applications are affected only when untrusted users can control `FormData` key names that are converted through axios.

Affected paths include direct use of `axios.formToJSON()` on untrusted `FormData` and axios requests in which attacker-controlled `FormData` is sent with `Content-Type: application/json`.

The observed failure is `RangeError: Maximum call stack size exceeded`. In local testing, this error is catchable, so process-wide crash depends on the consuming application's error handling and runtime behaviour.

## Affected Functionality

Affected functionality: - `axios.formToJSON(formData)` - Named ESM export `formToJSON` - Default `transformRequest` behaviour for `FormData` when `Content-Type` contains `application/json`

Unaffected functionality: - Normal multipart `FormData` submission without JSON serialisation - `toFormData`, which already enforces a `maxDepth` guard - Axios versions `<=0.27.2`, where `formDataToJSON`…

Most recent entries from all

GHSA-pmv8-rq9r-6j72 — Axios: Deep formToJSON Key Recursion Can Cause Denial of Service