GHSA-4ww2-rjh2-xpv9

Suggest an improvement
Source
https://github.com/advisories/GHSA-4ww2-rjh2-xpv9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4ww2-rjh2-xpv9/GHSA-4ww2-rjh2-xpv9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4ww2-rjh2-xpv9
Downstream
CGA (188)
Withdrawn
2026-08-31T20:02:56Z
Published
2026-08-01T15:30:27Z
Modified
2026-08-31T20:15:05Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pmv8-rq9r-6j72. This link is maintained to preserve external references.

Original Description

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-31T20:02:56Z",
    "nvd_published_at":  "2026-08-01T13:17:01Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / axios

Package

Name
axios
View open source insights on deps.dev
Purl
pkg:npm/axios

Affected ranges

Type
SEMVER
Events
Introduced
1.0.0

Database specific

last_known_affected_version_range 
"< 1.18.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4ww2-rjh2-xpv9/GHSA-4ww2-rjh2-xpv9.json"