Axios is a promise–based HTTP client used in browser and Node.js applications. In versions prior to 1.15.1 and 0.31.1, the toFormData routine performs an unbounded recursive walk of nested objects. A deeply nested request payload can cause the JavaScript engine to exhaust stack space and raise a RangeError, terminating the Node.js process. The primary impact is a denial of service: an attacker who can supply arbitrary request data to an Axios‑based client can trigger a crash that may bring down a service or host. This vulnerability is classified as CWE‑674, an unbounded recursion flaw, and also involves CWE‑770, a resource exhaustion issue. Mitigation requires preventing the unbounded recursion from executing against malicious data. The product’s maintainers have fixed the issue in the specified release versions.

The affected vendor is Axios. All Axios releases prior to 1.15.1 and 0.31.1 are vulnerable. Applications that depend on these older Axios packages and send deeply nested data in HTTP requests are at risk.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. Its EPSS score is less than 1%, signifying a low probability of exploitation in the wild. The CISA KEV catalog does not list it. Based on the description, the likely attack vector is through maliciously crafted HTTP requests that include deeply nested JSON objects sent to a service that uses Axios to process them. An attacker would need to control the request payload; if successful, the recursive traversal would trigger a RangeError, causing the Node.js process to crash and resulting in a denial of service.