GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
SummaryAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.If an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropriate error handling, process termination.ImpactApplications are affected only when untrusted users can control `FormData` key names that are converted through axios.Affected paths include direct use of `axios.formToJSON()` on untrusted `FormData` and axios requests in which attacker-controlled `FormData` is sent with `Content-Type: application/json`.The observed failure is `RangeError: Maximum call stack size exceeded`. In local testing, this error is catchable, so process-wide crash depends on the consuming application's error handling and runtime behaviour.Affected FunctionalityAffected functionality:`axios.formToJSON(formData)`Named ESM export `formToJSON`Default `transformRequest` behaviour for `FormData` when `Content-Type` contains `application/json`Unaffected functionality:Normal multipart `FormData` submission without JSON serialisation`toFormData`, which already enforces a `maxDepth` guardAxios versions `<=0.27.2`, where `formDataToJSON` was not presentTechnical DetailsThe vulnerable code is in `lib/helpers/formDataToJSON.js`.`parsePropPath()` splits a field name such as `a[x][x][x]` into path segments. `buildPath()` then recursively processes one segment per call without enforcing a maximum depth:A key with thousands of bracket-delimited segments causes thousands of recursive calls and can exceed the JavaScript engine's call stack limit.Relevant source locations:`lib/helpers/formDataToJSON.js` contains the unbounded recursive `buildPath()`.`lib/axios.js` exposes the helper as `axios.formToJSON`.`index.js` exposes `formToJSON` as a named export.`index.d.ts` and `index.d.cts` declare the public API.`lib/defaults/index.js` calls `formDataToJSON(data)` when JSON-serializing `FormData`.The inverse helper, `toFormData`, already enforces `maxDepth` and throws `AxiosError` with `ERR_FORM_DATA_DEPTH_EXCEEDED`, but `formDataToJSON` does not have an equivalent guard.Proof of Concept of AttackExpected result on affected versions:RangeError: Maximum call stack size exceededThe same condition can be reached via an axios request transformation when attacker-controlled `FormData` is sent with `Content-Type: application/json`.WorkaroundsApplications can reject or normalise untrusted form field names before calling `axios.formToJSON()`.Applications can avoid sending untrusted `FormData` through axios as JSON unless JSON conversion is required.Applications should catch errors around `formToJSON()` or axios requests that transform untrusted `FormData`.SummaryAn uncontrolled recursion vulnerability in `formDataToJSON` allows any user who controls FormData input to crash a Node.js process with a single request. The function recurses once per bracket-delimited segment in a FormData key name with no depth limit, so a key like `a[x][x][x]...` with 15,000+ segments exhausts the call stack. This is a denial-of-service that kills the process via an unrecoverable `RangeError`. The inverse function `toFormData` already enforces a `maxDepth` limit (default 100) for exactly this reason — `formDataToJSON` lacks the equivalent guard.Details**Vulnerable function:** `buildPath` in `lib/helpers/formDataToJSON.js`, lines 50–82.`buildPath(path, value, target, index)` is called recursively — once per segment in the parsed property path — with no depth check:The key is first split into segments by `parsePropPath` (line 17), which extracts every `[segment]` via regex. A key with 15,000 bracket pairs produces a 15,001-element array, causing 15,001 recursive calls — well beyond the V8 default stack limit (~10,000–15,000 frames).**`formDataToJSON` is a public API** consumed two ways:**Directly by consumers** — exported as `axios.formToJSON()` (`lib/axios.js:80`), with TypeScript declarations in both `index.d.ts:699` and `index.d.cts:708`, and documented in the API reference in four languages (`docs/pages/advanced/api-reference.md`).**Internally by `transformRequest`** — called at `lib/defaults/index.js:56` when the request body is `FormData` and `Content-Type` contains `application/json`:**Contrast with `toFormData`:** The inverse function (`lib/helpers/toFormData.js:118`) enforces `maxDepth` (default 100) and throws `AxiosError` with code `ERR_FORM_DATA_DEPTH_EXCEEDED` when exceeded. `formDataToJSON` has no equivalent protection.PoCRequires only Node.js and an unmodified axios v1.x install:Verified output on Node.js 22.22.3 against axios v1.16.1 (current `v1.x` HEAD):The process crashes. In a server context (e.g., Express middleware calling `axios.formToJSON()` on an uploaded form), a single crafted request terminates the process.Impact**Denial of Service (process crash).** Any unauthenticated user who can submit FormData to a Node.js application that passes it through `axios.formToJSON()` — or that sends it as a JSON-serialized FormData body via axios — can crash the server process with a single request. The `RangeError` from stack exhaustion is unrecoverable in many contexts (it cannot be reliably caught when the stack is already full). No authentication or special privileges are required; the attacker only needs to control a FormData key name.
CVSS v4.0 score: 6.3