Listen to this Post
How GHSA-pmv8-rq9r-6j72 Works
Axios versions starting from 0.28.0 introduce a public helper `formDataToJSON` (exposed as axios.formToJSON()) and use it internally when serialising `FormData` with Content-Type: application/json. The vulnerability resides in lib/helpers/formDataToJSON.js, where `parsePropPath()` splits a field name like `a
[x][bash]` into path segments, and `buildPath()` recursively processes one segment per call without enforcing any maximum depth. A key with thousands of bracket-delimited segments—for example, <code>'a' + '[bash]'.repeat(15000)</code>—produces a path array of 15,001 elements. `buildPath()` then recurses once per segment, eventually exceeding the JavaScript engine's call stack limit (typically ~10,000–15,000 frames in V8) and throwing an unrecoverable <code>RangeError: Maximum call stack size exceeded</code>. <h2 style="color: blue;">This flaw affects two primary paths:</h2> <ul> <li>Direct API use – calling `axios.formToJSON(fd)` or the named ESM export `formToJSON` on untrusted <code>FormData</code>.</li> <li>Internal request transform – when an axios request sends `FormData` with a `Content-Type` header containing <code>application/json</code>, the default `transformRequest` invokes <code>formDataToJSON(data)</code>. The inverse helper `toFormData` already enforces a `maxDepth` guard (default 100) and throws a controlled `AxiosError` with code `ERR_FORM_DATA_DEPTH_EXCEEDED` when exceeded. `formDataToJSON` has no such protection. In a server context (e.g., Express middleware processing uploaded forms), a single crafted request can terminate the entire Node.js process. While the error is technically catchable in local testing, once the stack is full, recovery is unreliable and depends entirely on the application's error-handling behaviour.</li> </ul> <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Node.js Version: 0.28.0 – 0.32.0, 1.0.0 – 1.17.0 Vulnerability: Uncontrolled Recursion (DoS) Severity: Moderate date: 2026-07-06 <h2 style="color: blue;">Prediction: 2026-07-20 (v0.33.0, v1.18.0)</h2> <h2 style="color: blue;">What Undercode Say:</h2> Analytics – The vulnerability is triggered synchronously before any network I/O. In default axios requests, the error surfaces as a rejected Promise; direct `formToJSON()` calls throw immediately. Server-side applications are the primary risk when remote users can submit arbitrary form field names. <h2 style="color: blue;">Bash / Commands – Check your axios version:</h2> [bash] npm list axios
PoC Code – Direct `formToJSON()` exploit:
import { formToJSON } from "axios";
const fd = new FormData();
fd.append("a" + "[bash]".repeat(15000), "value");
try {
formToJSON(fd);
console.log("not vulnerable");
} catch (err) {
console.log(<code>${err.constructor.name}: ${err.message}</code>);
}
// Expected: RangeError: Maximum call stack size exceeded
PoC via axios request:
import axios from "axios";
const fd = new FormData();
fd.append("a" + "[bash]".repeat(15000), "value");
await axios.post("http://127.0.0.1:1/", fd, {
headers: { "Content-Type": "application/json" }
}).catch((err) => console.log(<code>${err.constructor.name}: ${err.message}</code>));
Exploit:
An unauthenticated attacker submits a `FormData` object with a single key containing thousands of nested bracket segments (e.g., `a[bash][x][bash]…` repeated 15,000+ times) to any application endpoint that passes that `FormData` through `axios.formToJSON()` or sends it via axios with Content-Type: application/json. The unbounded recursion exhausts the V8 call stack, crashing the Node.js process. No special privileges are required; the attacker only needs to control the `FormData` key name.
Protection:
- Upgrade to axios v0.33.0 or v1.18.0 (or later), where the fix has been applied.
- Reject or normalise untrusted form field names before calling
axios.formToJSON(). - Avoid sending untrusted `FormData` through axios with
Content-Type: application/json; use multipart `FormData` instead, which bypasses the vulnerable path. - Catch errors around `formToJSON()` or axios requests that transform untrusted
FormData, though note that stack exhaustion may not be reliably catchable in all runtimes.
Impact:
Denial of Service (process crash) – Any unauthenticated user who can submit `FormData` to a Node.js application that passes it through axios.formToJSON()—or sends it as a JSON-serialised `FormData` body via axios—can crash the server process with a single request. The `RangeError` from stack exhaustion is unrecoverable in many contexts; it cannot be reliably caught when the stack is already full. No authentication or special privileges are required.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
