CyberRota Analysis
AI-GeneratedAffected versions of axios prior to 0.33.0 and 1.18.0 have an incomplete depth-limit bypass vulnerability in the toFormData.js module, which can be exploited by attackers manipulating object keys and nested values. This can lead to a denial of service through a RangeError during JSON serialization. Developers and organizations using these specific axios versions should prioritize updating to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.