High [CVE-2026-67312] Denial of Service via uncontrolled recursion in form data processing

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json).

When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names.

This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. This vulnerability affects applications that pass attacker-controlled FormData field names to axios' FormData-to-JSON conversion.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-674.

Affected products named by the advisory: Red Hat Developer Hub 1.10; Red Hat Developer Hub 1.9; Red Hat Hardened Images; Red Hat OpenShift Dev Spaces 3.30; and 4 more.