Axios formDataToJSON Vulnerability: Potential Denial of Service Risk
Axios versions 0.28.0 and later reportedly contain uncontrolled recursion in formDataToJSON, which can cause a denial of service when processing attacker-controlled FormData field names.
What happened
Axios versions 0.28.0 and later appear to have an issue where the formDataToJSON function can enter uncontrolled recursion when processing FormData with attacker-controlled field names. This can lead to a denial of service condition. The vulnerability is under investigation and has been tracked under GHSA-42H9-826W-CGV3.
To assess your exposure, check if your application uses Axios version 0.28.0 or later and if it processes FormData with untrusted field names using the application/json content type. It is recommended to avoid using axios.formToJSON() or sending FormData with application/json content type if the field names are not trusted.
For more detailed information, consult the primary source at https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3.
How 0Day mitigates this
axios is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.