GHSA-42h9-826w-cgv3: Axios: Excessive recursion in formDataToJSON can cause denial of service

Summary Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type. Applications are affected when they pass attacker-controlled FormData field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw RangeError: Maximum call stack size exceeded, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination. Impact The impact is denial of service against applications that process untrusted FormData field names through axios' FormData-to-JSON conversion. The vulnerable path is not reached by merely installing axios, by normal multipart FormData pass-through, or by ordinary axios requests that do not request JSON serialisation of FormData. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of formToJSON() throws synchronously. Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with formToJSON() or sends them through axios as JSON. Affected Functionality Affected APIs and paths: - axios.formToJSON(formData) - import { formToJSON } from "axios" - lib/helpers/formDataToJSON.js - axios default transformRequest when data is FormData and Content-Type contains application/json Unaffected or lower-risk paths: - Normal multipart FormData requests without JSON Content-Type - toFormData() object-to-FormData serialisation, which already has a maxDepth guard - Axios versions before 0.28.0, where this helper and public API were not present Technical Details lib/helpers/formDataToJSON.js parses a form field name into path segments with parsePropPath(). For a key such as a[x][x][x], each b