Technical impact
Axios versions 0.28.0 through 1.18.0 contain an uncontrolled recursion vulnerability in the formDataToJSON routine. When the routine processes FormData field names that contain deeply nested bracket segments, it recurses until the JavaScript call stack limit is reached. This triggers a RangeError, causing the request to fail or, if the application does not catch the exception, the process can terminate, resulting in a denial of service.
Affected Systems
All systems that use Axios within the 0.28.0 to 1.18.0 range are affected. The vulnerability exists in the Axios library itself, so any Node.js application that imports or requires Axios in that version range is at risk regardless of the surrounding application code.
Risk and Exploitability
The CVSS score of 6.3 indicates a moderate severity impact on availability. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation data. An attacker can exploit the flaw by sending an HTTP request containing FormData field names with thousands of nested brackets, which is a feasible attack vector against applications that expose user‑controlled form handling. Successful exploitation would consume server resources and cause the application to fail or crash.
Github GHSA