CVE-2026-42039

Summary

toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.

Details

lib/helpers/toFormData.js:210 defines an inner build(value, path) that recurses into every object/array child (line 225: build(el, path ? path.concat(key) : [key])). The only safeguard is a stack array used to detect circular references; there is no maximum depth and no try/catch around the recursion. Because build calls itself once per nesting level, a payload nested roughly 2000+ levels deep exhausts V8's call stack.

toFormData is the serializer behind FormData request bodies and AxiosURLSearchParams (used by buildURL when params is an object with URLSearchParams unavailable, see lib/helpers/buildURL.js:53 and lib/helpers/AxiosURLSearchParams.js:36). Any server-side code that forwards a client-supplied object into axios({ data, params }) therefore reaches the recursive walker with attacker-controlled depth.

The RangeError is thrown synchronously from inside forEach, escapes toFormData, and propagates out of the axios request call. In typical Express/Fastify request handlers this terminates the running request; in synchronous startup paths or worker threads it can crash the whole process.

PoC

import toFormData from 'axios/lib/helpers/toFormData.js';
import FormData from 'form-data';

function nest(depth) {
  let o = { leaf: 1 };
  for (let i = 0; i < depth; i++) o = { a: o };
  return o;
}

try {
  toFormData(nest(2500), new FormData());
} catch (e) {
  console.log(e.name + ': ' + e.message);
}
// RangeError: Maximum call stack size exceeded

Server-side reachability example:

// vulnerable proxy pattern
app.post('/forward', async (req, res) => {
  await axios.post('https://upstream/api', req.body); // req.body user-controlled
  res.send('ok');
});
// attacker POST /forward with {"a":{"a":{"a":... 2500 deep ...}}}
// -> toFormData build() overflows -> request handler crashes

Verified on axios 1.15.0 (latest, 2026-04-10), Node.js 20, 3/3 PoC runs reproduce the RangeError at depth 2500.

Impact

A remote, unauthenticated attacker who can influence an object passed to axios as request data or params triggers an uncaught RangeError inside the synchronous recursive walker. In server-side applications that proxy or re-send client JSON through axios this crashes the request handler and, in worker/cluster setups, the process. Fix by bounding recursion depth in toFormData's build function (reject or throw on depths beyond a configurable limit, e.g. 100) or rewriting the walker iteratively.

Root has patched CVE-2026-42039 in the axios package for Root:npm. Multiple fixed versions available.

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.

TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.

TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.

TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.

TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.

TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.

TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.15.3-tuxcare.4.

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.18.1-tuxcare.3.

TuxCare rebuilt axios to address 1 CVE. Fixed in 0.27.2-tuxcare.4.

TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.

TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.

TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.15.0-tuxcare.1.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.