{"id":"CVE-2026-42039","aliases":["CLSA-2026-1782521951","CLSA-2026-1782781178","CLSA-2026-1782867613","CLSA-2026-1783040460","CLSA-2026-1783299714","CLSA-2026-1784769505","CLSA-2026-1784769531","CLSA-2026-1784856205","CLSA-2026-1784856367","CLSA-2026-1784856377","CLSA-2026-1785291686","CLSA-2026-1790764333","CLSA-2026-1793101849","CLSA-2026-1793110604","CLSA-2026-1793874599","CLSA-2026-1794060370","DEBIAN-CVE-2026-42039","EUVD-2026-25605","GHSA-62hf-57xw-28j9","UBUNTU-CVE-2026-42039","openSUSE-SU-2026:11126-1"],"status":"published","title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00772,"percentile":0.56164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-770"],"published":"2026-04-24T18:01:30Z","modified":"2026-11-12T10:00:27Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.15.1","0.31.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["0.27.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.15.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.15.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.31.0"},{"fixed":"0.31.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.1"}]}],"versions":["0.19.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.1-tuxcare.0"},{"fixed":"0.21.1-tuxcare.1"}]}],"versions":["0.21.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.4-tuxcare.0"},{"fixed":"0.21.4-tuxcare.1"}]}],"versions":["0.21.4"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-tuxcare.0"},{"fixed":"0.24.0-tuxcare.1"}]}],"versions":["0.24.0"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.1"}]}],"versions":["0.26.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.3"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.5-tuxcare.0"},{"fixed":"1.7.5-tuxcare.2"}]}],"versions":["1.7.5","1.7.5-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.1"}]}],"versions":["1.7.9"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.15.3-tuxcare.0"},{"fixed":"0.15.3-tuxcare.4"}]}],"versions":["0.15.3","0.15.3-tuxcare.1","0.15.3-tuxcare.2","0.15.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.1-tuxcare.0"},{"fixed":"0.18.1-tuxcare.3"}]}],"versions":["0.18.1","0.18.1-tuxcare.1","0.18.1-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.4"}]}],"versions":["0.27.2","0.27.2-tuxcare.1","0.27.2-tuxcare.2","0.27.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.1"}]}],"versions":["1.13.5"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.2-tuxcare.0"},{"fixed":"1.12.2-tuxcare.1"}]}],"versions":["1.12.2"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.3"}]}],"versions":["1.13.6","1.13.6-tuxcare.1","1.13.6-tuxcare.2"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0-tuxcare.0"},{"fixed":"1.15.0-tuxcare.1"}]}],"versions":["1.15.0"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.21.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.21.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.15.1"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49}],"products":[{"vendor":"axios","product":"axios"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"gatekeeper 3"},{"vendor":"red hat","product":"hawtio hawtio 4.4.0"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.1"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.11"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"},{"vendor":"red hat","product":"network observability (netobserv) 1.11.0"},{"vendor":"red hat","product":"network observability (netobserv) 1.12.2"},{"vendor":"red hat","product":"network observability operator"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"},{"vendor":"red hat","product":"red hat advanced cluster security for kubernetes 4.10"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat data grid 8.6.1"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat migration toolkit for applications 8.1"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.28"},{"vendor":"red hat","product":"red hat openshift service mesh 2.6"},{"vendor":"red hat","product":"red hat openshift service mesh 3.0"},{"vendor":"red hat","product":"red hat openshift service mesh 3.1"},{"vendor":"red hat","product":"red hat openshift service mesh 3.2"},{"vendor":"red hat","product":"red hat openshift service mesh 3.3"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.18"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"red hat","product":"red hat trusted profile analyzer"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42039","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461630","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16874","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24473","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25273","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22619","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21338","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25041","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17468","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17474","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48670","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16476","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16534","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16532","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16535","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16542","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26214","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26225","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25271","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24536","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17657","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17699","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19109","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.15.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-62hf-57xw-28j9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42039.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42039","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-42039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42039","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42039","title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:01:30.775Z","modified":"2026-09-10T12:04:56.504Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-25605","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:01:30Z","modified":"2026-09-10T12:04:56Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-62hf-57xw-28j9","title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"### Summary\ntoFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.\n\n### Details\nlib/helpers/toFormData.js:210 defines an inner `build(value, path)` that recurses into every object/array child (line 225: `build(el, path ? path.concat(key) : [key])`). The only safeguard is a `stack` array used to detect circular references; there is no maximum depth and no try/catch around the recursion. Because `build` calls itself once per nesting level, a payload nested roughly 2000+ levels deep exhausts V8's call stack.\n\n`toFormData` is the serializer behind `FormData` request bodies and `AxiosURLSearchParams` (used by `buildURL` when `params` is an object with `URLSearchParams` unavailable, see `lib/helpers/buildURL.js:53` and `lib/helpers/AxiosURLSearchParams.js:36`). Any server-side code that forwards a client-supplied object into `axios({ data, params })` therefore reaches the recursive walker with attacker-controlled depth.\n\nThe RangeError is thrown synchronously from inside `forEach`, escapes `toFormData`, and propagates out of the axios request call. In typical Express/Fastify request handlers this terminates the running request; in synchronous startup paths or worker threads it can crash the whole process.\n\n### PoC\n```js\nimport toFormData from 'axios/lib/helpers/toFormData.js';\nimport FormData from 'form-data';\n\nfunction nest(depth) {\n  let o = { leaf: 1 };\n  for (let i = 0; i \u003c depth; i++) o = { a: o };\n  return o;\n}\n\ntry {\n  toFormData(nest(2500), new FormData());\n} catch (e) {\n  console.log(e.name + ': ' + e.message);\n}\n// RangeError: Maximum call stack size exceeded\n```\n\nServer-side reachability example:\n```js\n// vulnerable proxy pattern\napp.post('/forward', async (req, res) =\u003e {\n  await axios.post('https://upstream/api', req.body); // req.body user-controlled\n  res.send('ok');\n});\n// attacker POST /forward with {\"a\":{\"a\":{\"a\":... 2500 deep ...}}}\n// -\u003e toFormData build() overflows -\u003e request handler crashes\n```\n\nVerified on axios 1.15.0 (latest, 2026-04-10), Node.js 20, 3/3 PoC runs reproduce the RangeError at depth 2500.\n\n### Impact\nA remote, unauthenticated attacker who can influence an object passed to axios as request `data` or `params` triggers an uncaught RangeError inside the synchronous recursive walker. In server-side applications that proxy or re-send client JSON through axios this crashes the request handler and, in worker/cluster setups, the process. Fix by bounding recursion depth in `toFormData`'s `build` function (reject or throw on depths beyond a configurable limit, e.g. 100) or rewriting the walker iteratively.","status":"published","published":"2026-05-05T00:34:32Z","modified":"2026-06-08T15:54:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2026-42039","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:16:30.827Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-12T01:26:59.157514Z"}],"osv":[{"id":"CVE-2026-42039","title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:01:30.775Z","modified":"2026-10-28T02:31:14.420107939Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-42039","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:16:30.827Z","modified":"2026-11-12T10:00:27.908454091Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-12T10:16:18.390123Z"},{"id":"GHSA-62hf-57xw-28j9","title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"### Summary\ntoFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.\n\n### Details\nlib/helpers/toFormData.js:210 defines an inner `build(value, path)` that recurses into every object/array child (line 225: `build(el, path ? path.concat(key) : [key])`). The only safeguard is a `stack` array used to detect circular references; there is no maximum depth and no try/catch around the recursion. Because `build` calls itself once per nesting level, a payload nested roughly 2000+ levels deep exhausts V8's call stack.\n\n`toFormData` is the serializer behind `FormData` request bodies and `AxiosURLSearchParams` (used by `buildURL` when `params` is an object with `URLSearchParams` unavailable, see `lib/helpers/buildURL.js:53` and `lib/helpers/AxiosURLSearchParams.js:36`). Any server-side code that forwards a client-supplied object into `axios({ data, params })` therefore reaches the recursive walker with attacker-controlled depth.\n\nThe RangeError is thrown synchronously from inside `forEach`, escapes `toFormData`, and propagates out of the axios request call. In typical Express/Fastify request handlers this terminates the running request; in synchronous startup paths or worker threads it can crash the whole process.\n\n### PoC\n```js\nimport toFormData from 'axios/lib/helpers/toFormData.js';\nimport FormData from 'form-data';\n\nfunction nest(depth) {\n  let o = { leaf: 1 };\n  for (let i = 0; i \u003c depth; i++) o = { a: o };\n  return o;\n}\n\ntry {\n  toFormData(nest(2500), new FormData());\n} catch (e) {\n  console.log(e.name + ': ' + e.message);\n}\n// RangeError: Maximum call stack size exceeded\n```\n\nServer-side reachability example:\n```js\n// vulnerable proxy pattern\napp.post('/forward', async (req, res) =\u003e {\n  await axios.post('https://upstream/api', req.body); // req.body user-controlled\n  res.send('ok');\n});\n// attacker POST /forward with {\"a\":{\"a\":{\"a\":... 2500 deep ...}}}\n// -\u003e toFormData build() overflows -\u003e request handler crashes\n```\n\nVerified on axios 1.15.0 (latest, 2026-04-10), Node.js 20, 3/3 PoC runs reproduce the RangeError at depth 2500.\n\n### Impact\nA remote, unauthenticated attacker who can influence an object passed to axios as request `data` or `params` triggers an uncaught RangeError inside the synchronous recursive walker. In server-side applications that proxy or re-send client JSON through axios this crashes the request handler and, in worker/cluster setups, the process. Fix by bounding recursion depth in `toFormData`'s `build` function (reject or throw on depths beyond a configurable limit, e.g. 100) or rewriting the walker iteratively.","status":"published","published":"2026-05-05T00:34:32Z","modified":"2026-09-10T03:50:45.703789635Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2026-42039","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","status":"published","published":"2026-04-24T18:16:00Z","modified":"2026-10-17T13:00:04.180200777Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1782521951","title":"TuxCare security update for axios (17 CVEs)","description":"TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:51.501643897Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782781178","title":"TuxCare security update for axios (16 CVEs)","description":"TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T13:57:56.893232091Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782867613","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:47:51.552498386Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783040460","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T13:57:55.491180345Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783299714","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:03.671467748Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784769505","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.377144369Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769531","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.840967341Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856205","title":"TuxCare security update for axios (21 CVEs)","description":"TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:55.013314732Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856367","title":"TuxCare security update for axios (3 CVEs)","description":"TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.15.3-tuxcare.4.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.930150567Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856377","title":"TuxCare security update for axios (2 CVEs)","description":"TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.18.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.892974562Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291686","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.27.2-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.654761012Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790764333","title":"TuxCare security update for axios (28 CVEs)","description":"TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.","status":"published","published":"2026-09-30T10:32:13Z","modified":"2026-10-15T09:47:53.491657971Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110604","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.","status":"published","published":"2026-10-27T14:16:44Z","modified":"2026-10-27T19:30:03.618389185Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793874599","title":"TuxCare security update for axios (27 CVEs)","description":"TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.","status":"published","published":"2026-11-05T11:30:00Z","modified":"2026-11-05T13:15:17.383465117Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794060370","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.15.0-tuxcare.1.","status":"published","published":"2026-11-07T15:06:10Z","modified":"2026-11-07T19:00:38.800695575Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}