Axios introduced a helper function formDataToJSON in version 0.28.0 that converts FormData to JSON by parsing field names into path segments and recursively building the JSON object. The recursion depth is unbounded, so a FormData field name with thousands of nested bracket segments causes excessive recursion, leading to a RangeError due to maximum call stack size exceeded. This vulnerability affects axios.formToJSON(), the default transformRequest when sending FormData as application/json, and the public formToJSON API. Axios does not currently enforce a maximum recursion depth in formDataToJSON, unlike its inverse serializer which has a maxDepth guard. The vulnerability primarily risks server-side applications processing untrusted FormData field names. Exploitation results in denial of service by crashing or rejecting requests before network I/O.

Denial of service against applications that process untrusted FormData field names through axios' FormData-to-JSON conversion. Requests with deeply nested FormData keys cause a RangeError that can fail the request or terminate the process if unhandled. Normal FormData usage without JSON serialization is unaffected. The vulnerability does not allow code execution or data leakage but disrupts service availability.

No official patch or fix is currently available. Applications should avoid converting attacker-controlled FormData to JSON using axios.formToJSON() or by sending FormData with Content-Type application/json. Validate and reject FormData field names with excessive nesting depth before conversion or sending. Avoid setting Content-Type to application/json for untrusted FormData to bypass the vulnerable code path. Catching the RangeError can prevent process termination but does not fix the underlying recursion issue and should not be relied on as the primary mitigation.