Uncontrolled Recursion Affecting axios package, versions >=0.28.0 <0.33.0>=1.0.0 <1.18.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AXIOS-18060167
- published21 Jul 2026
- disclosed20 Jul 2026
- creditcleverlabs
Introduced: 20 Jul 2026
New CVE NOT AVAILABLE CWE-674 (opens in a new tab)How to fix?
Upgrade axios to version 0.33.0, 1.18.0 or higher.
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Uncontrolled Recursion in the buildPath() function of lib/helpers/formDataToJSON.js, which recurses once per FormData key path segment without enforcing a maximum depth. An attacker can crash the process by supplying a FormData field name with thousands of nested bracket segments, such as a[x][x][x]..., which drives formDataToJSON() into recursion that exhausts the JavaScript call stack with a RangeError. Exploitation requires the application to process untrusted FormData through formToJSON() or by sending it with a JSON content type.