axios before version 0.33.0 exposes a flaw in the toFormData.js module where the depth limit is not fully enforced when serializing objects with top‑level keys that end in '{}'. If an attacker can supply such keys and nested values, the JSON.stringify call will recurse without bound, triggering a RangeError that aborts the current request. This results in an application‑level denial of service, affecting the availability of services that rely on axios for request serialization. The weakness is mapped to CWE‑674, describing an uncontrolled recursion or invalid recursion depth.

The affected product is the popular Axios HTTP client for Node.js, specifically all releases prior to 0.33.0. Any Node.js application that imports Axios and uses its form or parameter serialization features is vulnerable, regardless of the surrounding environment or configuration.

The CVSS score of 6.9 indicates a medium severity. Because no EPSS is available, the likelihood of exploitation cannot be quantified precisely, but the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote: a maliciously crafted HTTP request carrying a payload that satisfies Axios's form or query parameter serialization can trigger the crash. No elevated privileges or code execution are required; the attack merely stops the affected request from completing, making it a classic resource exhaustion problem.