Description
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | 0.28.0 – < 0.33.0, 1.0.0 – < 1.18.0 | 0.33.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.18.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
| Debian 12 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.2.hum1 | RHSA-2026:47619 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.3.hum1 | RHSA-2026:48241 |
| Red Hat Hardened Images 1 | jaeger | 2.20.0-0.8.hum1 | RHSA-2026:48758 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-nbdime | 4.0.4-24.1 | openSUSE-SU-2026:11458-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r30 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r26 | — |
| Wolfi rolling | langfuse-3 +1 | 3.223.0-r0 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | lerna | 9.0.7-r11 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r8 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r11 | — |
| Wolfi rolling | prism | 5.16.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 0.28.0, < 0.33.0 | 0.33.0 | GHSA-pmv8-rq9r-6j72 |
| npm | axios | >= 1.0.0, < 1.18.0 | 1.18.0 | GHSA-pmv8-rq9r-6j72 |
Advisories 5
- RHSA-2026:48758 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:48241 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:47619 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2958 IBM License Metric Tool: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- openSUSE-SU-2026:11458-1 jupyter-nbdime-7.0.4-24.1 on GA media SUSE / openSUSE Security Updates · Aug 6, 2026
References
- GitHub Security Advisory (GHSA-pmv8-rq9r-6j72) vendor-advisory
- VulnCheck Advisory: axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON third-party-advisory