CVE-2026-42039: Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-24 · updated 2026-09-10
Weakness: CWE-674

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

Affected products

axios: before 0.31.1; from 1.0.0 before 1.15.1 — fixed in 0.31.1, 1.15.1
Npm Axios: from 1.0.0 before 1.15.1; before 0.31.1 — fixed in 1.15.1, 0.31.1

How to fix

Upgrade to a fixed version: axios 0.31.1, 1.15.1; Npm Axios 1.15.1, 0.31.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42039 or the next vulnerability affects your stack