axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth‑limit bypass in toFormData.js when serializing objects with top‑level keys ending in '{}'. When an attacker supplies such keys and nested values, the JSON.stringify call recurses without bound, causing a RangeError that aborts the current request and leads to application‑level denial of service. The flaw mirrors CWE‑674 and CWE‑770, representing an uncontrolled recursion or invalid recursion depth and resource exhaustion that harms availability of services relying on axios for request serialization.

The affected product is the popular Axios HTTP client for Node.js, specifically releases prior to 0.33.0 in the 0.x series and prior to 1.18.0 in the 1.x series. Any Node.js application that imports Axios and uses its form or parameter serialization features is vulnerable, regardless of surrounding environment or configuration.

The CVSS score of 6.9 indicates a medium severity. The EPSS score of <1% indicates a very low probability of exploitation, but it is still noteworthy that the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote: a maliciously crafted HTTP request carrying a payload that satisfies Axios's form or query parameter serialization can trigger the crash. No elevated privileges or code execution are required; the attack merely stops the affected request from completing, making it a classic resource exhaustion problem.