CVE-2026-42039: Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

May 5, 2026 (updated June 8, 2026)

toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.

References

github.com/advisories/GHSA-62hf-57xw-28j9
github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f
github.com/axios/axios/releases/tag/v1.15.1
github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9
nvd.nist.gov/vuln/detail/CVE-2026-42039

Code Behaviors & Features

Detect and mitigate CVE-2026-42039 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →