CVE Feed

    Dashboard / CVE / CVE-2026-42039

    CVE-2026-42039

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.

    Published:Apr 24, 2026
    Last Modified:Apr 28, 2026
    EPS:Apr 24, 2026
    EPSS Score:0.00052
    CVSS Score:7.5

    Affected Products

    Vendor
    Axios
    Product
    Axios

    Exploits

    https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9

    Related CVEs

    CVE-2026-67321 (CVSS 6.9) — axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor…
    CVE-2026-67318 (CVSS 6.3) — axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed …
    CVE-2026-67319 (CVSS 6.3) — axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object…
    CVE-2026-67312 (CVSS 6.3) — axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa…
    CVE-2026-67315 (CVSS 6.9) — axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i…
    CVE-2026-67316 (CVSS 6.3) — axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p…
    CVE-2026-67320 (CVSS 8.3) — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. …
    CVE-2026-67313 (CVSS 6.3) — axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel…
    CVE-2026-67314 (CVSS 6.3) — axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl…
    CVE-2026-67317 (CVSS 6.3) — axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t…

    References

    https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9
    https://access.redhat.com/errata/RHSA-2026:14937
    https://access.redhat.com/errata/RHSA-2026:16476
    https://access.redhat.com/errata/RHSA-2026:16532
    https://access.redhat.com/errata/RHSA-2026:16534
    https://access.redhat.com/errata/RHSA-2026:16535
    https://access.redhat.com/errata/RHSA-2026:16542
    https://access.redhat.com/errata/RHSA-2026:16874
    https://access.redhat.com/errata/RHSA-2026:17468
    https://access.redhat.com/errata/RHSA-2026:17474
    https://access.redhat.com/errata/RHSA-2026:17657
    https://access.redhat.com/errata/RHSA-2026:17699
    https://access.redhat.com/errata/RHSA-2026:19109
    https://access.redhat.com/errata/RHSA-2026:19375
    https://access.redhat.com/errata/RHSA-2026:20889
    https://access.redhat.com/errata/RHSA-2026:20938
    https://access.redhat.com/errata/RHSA-2026:21017
    https://access.redhat.com/errata/RHSA-2026:21338
    https://access.redhat.com/errata/RHSA-2026:21772
    https://access.redhat.com/errata/RHSA-2026:22465
    https://access.redhat.com/errata/RHSA-2026:22619
    https://access.redhat.com/errata/RHSA-2026:22629
    https://access.redhat.com/errata/RHSA-2026:22840
    https://access.redhat.com/errata/RHSA-2026:23361
    https://access.redhat.com/errata/RHSA-2026:24473
    https://access.redhat.com/errata/RHSA-2026:24536
    https://access.redhat.com/errata/RHSA-2026:24539
    https://access.redhat.com/errata/RHSA-2026:24853
    https://access.redhat.com/errata/RHSA-2026:24977
    https://access.redhat.com/errata/RHSA-2026:25041
    https://access.redhat.com/errata/RHSA-2026:25089
    https://access.redhat.com/errata/RHSA-2026:25271
    https://access.redhat.com/errata/RHSA-2026:25273
    https://access.redhat.com/errata/RHSA-2026:26214
    https://access.redhat.com/errata/RHSA-2026:26225
    https://access.redhat.com/errata/RHSA-2026:33574
    https://access.redhat.com/errata/RHSA-2026:36882
    https://access.redhat.com/errata/RHSA-2026:48085
    https://access.redhat.com/errata/RHSA-2026:48670
    https://access.redhat.com/errata/RHSA-2026:50300
    https://access.redhat.com/security/cve/CVE-2026-42039
    https://bugzilla.redhat.com/show_bug.cgi?id=2461630
    https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High