Axios Vulnerability: Excessive Recursion in formDataToJSON
Axios versions 0.28.0 and later reportedly contain uncontrolled recursion in formDataToJSON, which can cause a denial of service when processing attacker-controlled FormData field names.
What happened
Axios versions 0.28.0 and later are under investigation for a potential denial of service vulnerability. The issue appears to stem from uncontrolled recursion in the formDataToJSON function, which can be triggered when processing FormData with attacker-controlled field names. This could lead to a denial of service if the FormData is not properly sanitized.
To assess your exposure, check if your project uses Axios version 0.28.0 or later. If so, review your code for usage of axios.formToJSON() or sending FormData with application/json content type where field names are not trusted. As a precaution, avoid using these functions until the issue is resolved.
For more details, consult the primary source: [GHSA-42h9-826w-cgv3] Axios: Excessive recursion in formDataToJSON can cause denial of service (https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3).
How 0Day mitigates this
axios is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.