The vulnerability exists in the axios library's formDataToJSON function, exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. The function recursively processes bracket-delimited segments of FormData key names without enforcing a maximum recursion depth, allowing an attacker to craft keys with thousands of nested segments (e.g., 'a[x][x][x]...') that exhaust the JavaScript call stack. This leads to a RangeError: Maximum call stack size exceeded, causing denial of service by crashing the Node.js process or failing the request. The inverse function toFormData enforces a maxDepth guard, but formDataToJSON lacks this protection. The vulnerability affects axios versions >=0.28.0 <0.33.0 and >=1.0.0 <1.18.0. Exploitation requires attacker control over FormData key names that are JSON serialized by axios.

Applications using affected axios versions that accept untrusted FormData key names and serialize them to JSON are vulnerable to denial of service via call stack exhaustion. The impact is a RangeError causing request failure or process termination depending on error handling. This can disrupt service availability but does not directly lead to code execution or data breach. The vulnerability is limited to scenarios where attacker-controlled FormData keys are processed through axios.formToJSON or axios requests with Content-Type: application/json and FormData payloads.

No official patch information is provided in the source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, applications should reject or normalize untrusted FormData key names before passing them to axios.formToJSON. Avoid sending untrusted FormData through axios as JSON unless necessary. Implement error handling to catch exceptions from formToJSON or axios requests that transform untrusted FormData to prevent process crashes.