The vulnerability exists in axios's formDataToJSON function, exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json. When an attacker supplies FormData field names containing thousands of nested bracket-delimited segments, the buildPath() function recurses without bounds, exhausting the JavaScript call stack. This leads to a RangeError and denial of service for the affected request or process termination in applications lacking proper error handling. The affected versions are axios >=0.28.0 <0.33.0 and >=1.0.0 <1.18.0.

An attacker can cause denial of service by sending specially crafted FormData with deeply nested field names, triggering unbounded recursion and crashing the JavaScript call stack. This disrupts the availability of the affected application or service. There is no indication of code execution or data exposure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should implement input validation or limit the depth of nested FormData field names to prevent unbounded recursion. Proper error handling should be in place to avoid process termination on stack overflow errors.