Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Description

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.18.0

  >= 0.28.0, < 0.33.0**

• Patched version(s): **1.18.0

  0.33.0**

References

• GHSA-pmv8-rq9r-6j72
• CWE-400
• CWE-770

Related Issues

• Axios: Excessive recursion in formDataToJSON can cause denial of service - Vulnerability
• string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
• Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
• mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability

You might also like:

5 Security Vulnerabilities You Can Fix Right Now

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

axios