Uncontrolled Recursion Affecting axios package, versions <0.33.0>=1.0.0 <1.18.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AXIOS-18060730
- published21 Jul 2026
- disclosed20 Jul 2026
- creditfg0x0
Introduced: 20 Jul 2026
New CVE NOT AVAILABLE CWE-674 (opens in a new tab)How to fix?
Upgrade axios to version 0.33.0, 1.18.0 or higher.
Overview
axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify() on a value when its top-level key ends in {}, before the maxDepth guard can inspect the nested structure. An attacker can crash the process by supplying an object with a top-level key ending in {} and thousands of levels of nesting, which native JSON.stringify() recurses through until the call stack overflows with a RangeError. Exploitation requires the application to pass untrusted input through axios as data or params, with a top-level key ending in {} and nesting beyond roughly 2500 to 3000 levels.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42039.