Description
Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.0.0, < 1.18.0 >= 0.28.0, < 0.33.0** Patched version(s): **1.18.0 0.33.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Deep formToJSON Key Recursion Can Cause Denial of Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Excessive recursion in formDataToJSON can cause denial of service - Vulnerability
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
- mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026