RangeError Crash in Axios HTTP Client for Browser and Node.js
CVE-2026-42039

6.9MEDIUM

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
24 April 2026

What is CVE-2026-42039?

The Axios HTTP client suffers from a vulnerability where the toFormData function does not limit recursion depth when processing nested objects. This can lead to a fatal RangeError that crashes the Node.js process, impacting the stability and reliability of applications that rely on Axios prior to versions 1.15.1 and 0.31.1. Developers are encouraged to update their Axios versions to mitigate this issue and ensure proper handling of deeply nested request data.

Affected Version(s)

axios >= 1.0.0, < 1.15.1 < 1.0.0, 1.15.1

axios < 0.31.1 < 0.31.1

References

https://github.com/axios/axios/security/advisories/GHSA-6...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.