Uncontrolled Recursion in Axios via Deeply Nested Bracket Segments

Executive Summary

This vulnerability affects axios versions 0.28.0 and later. It involves uncontrolled recursion in the formDataToJSON function when processing FormData field names with deeply nested bracket segments. Attackers can exploit this by sending FormData with field names containing thousands of nested brackets, which exhausts the JavaScript call stack and causes a RangeError. This leads to request failure or process termination in applications that do not handle the exception.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using axios versions 0.28.0 or later for FormData handling. Check for field names with deeply nested brackets in requests. Monitor for RangeError exceptions or process crashes during FormData processing.

Useful 0 Not Useful 0

Impact Analysis

If you use axios versions 0.28.0 or later in your application, an attacker could send specially crafted FormData with deeply nested brackets. This could crash your application or cause it to fail requests, leading to denial of service or unexpected behavior. Applications without proper exception handling are most vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update axios to a patched version below 0.28.0. If updating is not possible, implement input validation to reject FormData field names with excessive nested brackets. Add exception handling for RangeError in FormData processing.

Useful 0 Not Useful 0