Description
Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending in {}, axios calls JSON.stringify() on that value before the formSerializer.maxDepth guard can inspect the nested structure.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.15.1, < 1.18.0 >= 0.31.1, < 0.33.0** Patched version(s): **1.18.0 0.33.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios form serializer maxDepth bypass via {} metatoken and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026