Description
toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **<= 0.31.0 >= 1.0.0, < 1.15.1** Patched version(s): **0.31.1 1.15.1**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: unbounded recursion in toFormData causes DoS via deeply nested request data and gives you actionable findings to investigate.
Start a free scanRelated Issues
- yaml is vulnerable to Stack Overflow via deeply nested YAML collections - CVE-2026-33532
- flatted vulnerable to unbounded recursion DoS in parse() revive phase - CVE-2026-32141
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
- Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026