CVE-2026-42039

What it actually does

Axios versions prior to 1.15.1 and 0.31.1 can recursively process nested JavaScript objects without a depth limit when converting request data through toFormData. If attacker-controlled data is passed into Axios request serialization, an extremely deep object structure can trigger a JavaScript RangeError, typically a maximum call stack exhaustion condition, which can crash the Node.js process or cause request-handling workers to terminate. The impact is denial of service rather than data theft or code execution.

Why it matters to the business

Applications and services that use affected Axios versions may become unstable or unavailable if they accept nested user-supplied input and pass it into Axios for outbound HTTP requests. This can disrupt APIs, background jobs, webhook processors, integration services, and any Node.js workload that uses Axios to relay or transform external input. Although this issue is not currently listed in CISA KEV and has low EPSS activity, Axios is a widely used dependency, so exposure may be indirect through application dependency trees.

How an attack unfolds

An attacker first identifies an application endpoint or workflow that accepts structured input, such as JSON, form data, webhook payloads, or API parameters. The attacker submits a payload containing an intentionally deep nested object. If the application passes that object into Axios as request data and Axios attempts to convert it to FormData, the vulnerable toFormData implementation recursively walks the nested structure without enforcing a maximum depth. The recursion exhausts the JavaScript call stack and raises a RangeError. In Node.js services without defensive exception handling or process supervision, this can crash the process; in supervised deployments, repeated requests can create restart loops or sustained service degradation.

How to fix it

Upgrade Axios to a fixed release: use Axios 1.15.1 or later for the 1.x line, or Axios 0.31.1 or later for the 0.x line. Regenerate lockfiles after upgrading and ensure transitive dependencies do not continue to pin vulnerable Axios versions. If immediate upgrade is not possible, reduce exposure by validating and rejecting excessively deep request bodies before they are passed to Axios, enforcing request body size and nesting-depth limits, avoiding direct forwarding of untrusted objects into Axios serialization, and wrapping outbound request construction in error handling that prevents uncaught RangeError exceptions from terminating the process. Process managers, container orchestrators, and rate limits can reduce operational impact but do not fix the vulnerable recursion behavior.

How to confirm the fix worked

Confirm the deployed dependency tree no longer includes Axios versions earlier than 1.15.1 or 0.31.1 by checking package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, software composition analysis results, and runtime container images. Run `npm ls axios`, `yarn why axios`, or `pnpm why axios` in each affected project to verify the resolved version. Add regression tests that submit deeply nested objects to application inputs that are later sent with Axios and confirm the application rejects the payload or handles it without process termination. In production-like environments, verify request size and nesting-depth controls are active and that uncaught exceptions no longer occur when malformed nested payloads are received.

Typical attack path

1. Identify a Node.js application or service that uses Axios and accepts externally supplied structured input.
2. Find a code path where the application passes user-controlled nested data into an Axios request, especially multipart/form-data or FormData-style serialization.
3. Send a deeply nested object payload with hundreds or thousands of nested properties or array levels.
4. Trigger Axios to execute toFormData on the attacker-controlled object.
5. Cause a RangeError or maximum call stack exhaustion condition in the Node.js process.
6. Repeat requests as needed to crash workers, exhaust restart limits, or degrade service availability.

How to detect it

Look for evidence of availability attacks or crash attempts against Node.js services that use Axios. Relevant sources include application logs, Node.js process stderr/stdout, container logs, process manager logs such as PM2 or systemd, Kubernetes pod restart events, API gateway and reverse proxy access logs, web application firewall logs, and APM/error-tracking platforms. Focus on unexplained RangeError exceptions, maximum call stack errors, abrupt Node.js process exits, repeated container or worker restarts, and bursts of HTTP 5xx responses following requests with unusually large or deeply nested JSON/form payloads. In request logs or captured payload metadata, look for repeated nested object keys, bracket notation chains, deeply repeated field names, or excessive JSON nesting. Absence of a product-specific exploit string means detection should correlate crash telemetry with inbound requests that have abnormal body complexity and timing proximity to Axios request construction failures.

• RangeError: Maximum call stack size exceeded
• RangeError
• Maximum call stack size exceeded
• toFormData
• axios/lib/helpers/toFormData
• node_modules/axios/lib/helpers/toFormData
• node_modules/axios/dist/node/axios.cjs
• Uncaught RangeError
• FATAL ERROR
• process exited with code 1
• CrashLoopBackOff
• PM2 log: App [
• systemd: Main process exited
• npm ls axios

What your security team should do

• Prioritize inventory of Node.js applications and containers that include Axios, including transitive dependency usage.
• Upgrade all affected applications to Axios 1.15.1 or later, or 0.31.1 or later where the 0.x line must be retained.
• Search lockfiles and SCA reports for Axios versions below the fixed releases, and block vulnerable versions in dependency governance tooling.
• Implement input validation that enforces maximum JSON/form nesting depth before data reaches outbound Axios request construction.
• Review API gateways, body parsers, and application middleware for request body size, recursion, and complexity limits.
• Add monitoring and alerting for RangeError crashes, repeated Node.js worker restarts, and spikes in 5xx responses following deeply nested payload submissions.
• Ensure process supervision is configured to restart failed workers safely while also rate-limiting repeated crash attempts.
• Because this issue is not currently in KEV and has low observed EPSS likelihood, treat it as a broad dependency hygiene and service-resilience priority rather than an active mass-exploitation emergency unless local telemetry shows matching crash patterns.