GHSA-pmv8-rq9r-6j72: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropriate error handling, process termination. Impact Applications are affected only when untrusted users can control FormData key names that are converted through axios. Affected paths include direct use of axios.formToJSON() on untrusted FormData and axios requests in which attacker-controlled FormData is sent with Content-Type: application/json. The observed failure is RangeError: Maximum call stack size exceeded. In local testing, this error is catchable, so process-wide crash depends on the consuming application's error handling and runtime behaviour. Affected Functionality Affected functionality: - axios.formToJSON(formData) - Named ESM export formToJSON - Default transformRequest behaviour for FormData when Content-Type contains application/json Unaffected functionality: - Normal multipart FormData submission without JSON serialisation - toFormData, which already enforces a maxDepth guard - Axios versions <=0.27.2, where formDataToJSON was not present Technical Details The vulnerable code is in lib/helpers/formDataToJSON.js. parsePropPath() splits a field name such as a[x][x][x] into path segments. buildPath() then recursively processes one segment per call without enforcing a maximum depth: const result = buildPath(path, value, target[name], index); A key with thousands of bracket-delimited segments causes thousands of recursive calls and can exceed the JavaScript engine's call stack limit. Relevant source locations: - lib/helpers/formDataToJSON.js contains the unbounded rec