{"id":"CVE-2026-42039","aliases":["GHSA-62hf-57xw-28j9"],"url":"https://o3.security/vulnerability/CVE-2026-42039","summary":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","details":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","published":"2026-04-24T18:01:30.775Z","modified":"2026-08-07T11:51:04.974676479Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"axios","fixedVersion":"1.15.1"},{"ecosystem":"npm","name":"axios","fixedVersion":"0.31.1"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16476"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16534"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16535"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16542"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17474"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17657"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19109"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20938"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23361"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24473"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24536"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24539"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24853"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25271"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25273"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26214"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48085"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48670"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50300"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42039"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42039.json"},{"type":"ADVISORY","url":"https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461630"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:51:04.974676479Z"}}