axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in {}. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.
Weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | grafana12-4-main-12.4.6-0.2.hum1 | * |
| Red Hat Hardened Images | RedHat | grafana13-1-main-13.1.1-0.3.hum1 | * |
| Red Hat Hardened Images | RedHat | jaeger-main-2.20.0-0.8.hum1 | * |
| Node-axios | Ubuntu | upstream | * |