Uncontrolled Recursion in Axios FormData Handling

Executive Summary

This vulnerability affects the axios library versions between 0.28.0 to 0.33.0 and 1.0.0 to 1.18.0. It involves uncontrolled recursion in the formDataToJSON function, which is used when serializing FormData with Content-Type application/json. Attackers can exploit this by sending FormData with field names containing thousands of nested bracket-delimited segments, causing a stack overflow and denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable versions of axios (0.28.0 to 0.32.x or 1.0.0 to 1.17.x). Run: npm list axios or yarn list axios. If the version is within the affected range, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service for affected applications by crashing the server or process due to stack exhaustion. Applications using vulnerable axios versions may become unresponsive or terminate unexpectedly when processing malicious FormData input.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade axios to version 0.33.0 or later, or 1.18.0 or later. Use: npm update axios or yarn upgrade axios. If upgrading is not possible, implement input validation to restrict FormData field names and prevent deeply nested structures.

Useful 0 Not Useful 0