CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.
| CWE | CWE-674 |
| Vendor | axios |
| Product | axios |
| Published | Apr 24, 2026 |
| Last Updated | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for axios axios
Be the first to know when new high vulnerabilities affecting axios axios are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
axios / axios
>= 1.0.0, < 1.15.1 < 0.31.1
References
github.com: https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-42039 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2461630 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25089 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16874 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24473 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24539 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25273 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20938 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20889 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22619 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21338 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26234 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14937 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25041 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24977 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17468 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17474 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21772 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16476 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16534 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16532 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16535 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16542 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22629 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21017 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24853 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19375 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22465 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22840 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23361 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26214 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26225 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25271 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24536 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17657 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17699 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19109