Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Summary
Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json.
If an application passes attacker-controlled FormData field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropriate error handling, process termination.
Impact
Applications are affected only when untrusted users can control FormData key names that are converted through axios.
Affected paths include direct use of axios.formToJSON() on untrusted FormData and axios requests in which attacker-controlled FormData is sent with Content-Type: application/json.
The observed failure is RangeError: Maximum call stack size exceeded. In local testing, this error is catchable, so process-wide crash depends on the consuming application's error handling and runtime behaviour.
Affected Functionality
Affected functionality:
axios.formToJSON(formData)- Named ESM export
formToJSON - Default
transformRequest behaviour for FormData when Content-Type contains application/json
Unaffected functionality:
- Normal multipart
FormData submission without JSON serialisation toFormData, which already enforces a maxDepth guard- Axios versions
<=0.27.2, where formDataToJSON was not present
Technical Details
The vulnerable code is in lib/helpers/formDataToJSON.js.
parsePropPath() splits a field name such as a[x][x][x] into path segments. buildPath() then recursively processes one segment per call without enforcing a maximum depth:
```js
const result = buildPath(path, value, target[name], index);
```
A key with thousands of bracket-delimited segments causes thousands of recursive calls and can exceed the JavaScript engine's call stack limit.
Relevant source locations:
lib/helpers/formDataToJSON.js contains the unbounded recursive buildPath().lib/axios.js exposes the helper as axios.formToJSON.index.js exposes formToJSON as a named export.index.d.ts and index.d.cts declare the public API.lib/defaults/index.js calls formDataToJSON(data) when JSON-serializing FormData.
The inverse helper, toFormData, already enforces maxDepth and throws AxiosError with ERR_FORM_DATA_DEPTH_EXCEEDED, but formDataToJSON does not have an equivalent guard.
Proof of Concept of Attack
```js
import axios from 'axios';
const fd = new FormData();
fd.append('a' + '[x]'.repeat(15000), 'value');
try {
axios.formToJSON(fd);
console.log('not vulnerable');
} catch (e) {
console.log(${e.constructor.name}: ${e.message});
}
```
Expected result on affected versions:
RangeError: Maximum call stack size exceeded
The same condition can be reached via an axios request transformation when attacker-controlled FormData is sent with Content-Type: application/json.
Workarounds
Applications can reject or normalise untrusted form field names before calling axios.formToJSON().
Applications can avoid sending untrusted FormData through axios as JSON unless JSON conversion is required.
Applications should catch errors around formToJSON() or axios requests that transform untrusted FormData.
<details>
<summary>Original Source</summary>
Summary
An uncontrolled recursion vulnerability in formDataToJSON allows any user who controls FormData input to crash a Node.js process with a single request. The function recurses once per bracket-delimited segment in a FormData key name with no depth limit, so a key like a[x][x][x]... with 15,000+ segments exhausts the call stack. This is a denial-of-service that kills the process via an unrecoverable RangeError. The inverse function toFormData already enforces a maxDepth limit (default 100) for exactly this reason — formDataToJSON lacks the equivalent guard.
Details
Vulnerable function: buildPath in lib/helpers/formDataToJSON.js, lines 50–82.
buildPath(path, value, target, index) is called recursively — once per segment in the parsed property path — with no depth check:
```javascript
// lib/helpers/formDataToJSON.js, lines 50–82
function buildPath(path, value, target, index) {
let name = path[index++]; // advance one level
if (name === '__proto__') return true;
// ...
if (!isLast) {
// ...
const result = buildPath(path, value, target[name], index); // recurse — NO depth guard
// ...
}
}
```
The key is first split into segments by parsePropPath (line 17), which extracts every [segment] via regex. A key with 15,000 bracket pairs produces a 15,001-element array, causing 15,001 recursive calls — well beyond the V8 default stack limit (~10,000–15,000 frames).
formDataToJSON is a public API
