Axios: Excessive recursion in formDataToJSON can cause denial of service
- Severity:
- Medium
Description
Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.0.0, < 1.18.0 >= 0.28.0, < 0.33.0** Patched version(s): **1.18.0 0.33.0**
References
Related Issues
- Axios: Deep formToJSON Key Recursion Can Cause Denial of Service - Vulnerability
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
- Prototype pollution in Plist before 3.0.5 can cause denial of service - CVE-2022-22912
- Denial of Service in ipfs-bitswap - Vulnerability
You might also like:
- Tags:
- npm
- axios
Anything's wrong? Let us know Last updated on July 20, 2026