{"vulnerability": "GHSA-42h9-826w-cgv3", "sightings": [{"uuid": "05772ceb-35b4-41af-903b-2d5c2c7f15fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-42H9-826W-CGV3", "type": "seen", "source": "https://gist.github.com/alon710/cdf2a5ef96b6a707eafe65a3f00899a3", "content": "# GHSA-42H9-826W-CGV3: GHSA-42H9-826W-CGV3: Denial of Service via Uncontrolled Recursion in Axios formDataToJSON\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-42H9-826W-CGV3\n\n## Summary\nAn uncontrolled recursion vulnerability (CWE-674) in the Axios HTTP library allows remote attackers to cause a Denial of Service (DoS) by submitting form-data with deeply nested property keys. When Axios converts this form-data to JSON, it recursively traverses the path segments without establishing a maximum depth limit, resulting in a maximum call stack size exhaustion and a hard process crash in Node.js environments.\n\n## TL;DR\nUncontrolled recursion in Axios's `formDataToJSON` parser allows unauthenticated remote attackers to crash Node.js servers via a single crafted request with deeply nested form keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network (Unauthenticated HTTP POST/PUT requests)\n- **CVSS v3.1 Severity Score**: 7.5 (High)\n- **Impact Type**: Complete Denial of Service (Process Crash)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js backend servers using Axios to serialize or parse FormData JSON conversion payloads\n- Server-Side Rendering (SSR) frameworks forwarding client multipart payloads via Axios\n- Client-side browser applications processing untrusted nested inputs through Axios payload converters\n- **axios**: < 0.33.0 (Fixed in: `0.33.0`)\n- **axios**: >= 1.0.0, < 1.18.0 (Fixed in: `1.18.0`)\n\n## Mitigation\n\n- Upgrade Axios to a patched version (>= 0.33.0 or >= 1.18.0)\n- Implement incoming request parameter validation middleware to drop requests with excessive depth\n- Deploy WAF rules to detect and reject parameters with high bracket density\n\n**Remediation Steps:**\n1. Identify all instances of Axios in package.json and lockfile configurations.\n2. Upgrade Axios using npm update axios or yarn upgrade axios to version 1.18.0 (or 0.33.0 for 0.x configurations).\n3. Validate the upgrade by testing multipart/form-data deserialization workflows.\n4. Verify that process crash alerts are configured on PM2 or systemd to monitor node process lifecycles.\n\n## References\n\n- [GitHub Security Advisory GHSA-42H9-826W-CGV3](https://github.com/advisories/GHSA-42H9-826W-CGV3)\n- [Axios v0.33.0 Release Notes](https://github.com/axios/axios/releases/tag/v0.33.0)\n- [Axios v1.18.0 Release Notes](https://github.com/axios/axios/releases/tag/v1.18.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-42H9-826W-CGV3) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T18:32:13.622296Z"}, {"uuid": "0c06621e-0f81-40f0-bd21-e7ed4873585b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-42h9-826w-cgv3", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r6g7tzv2g", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nGHSA-42h9-826w-cgv3 impacts axios in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/615\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-07-21T12:01:34.808690Z"}]}