Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| axios | axios | >= 1.0.0, < 1.15.1; < 0.31.1 |
| Red Hat | HawtIO HawtIO 4.4.0 | — |
| Red Hat | Red Hat Data Grid 8.6.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.11 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.8 | — |
| Red Hat | multicluster engine for Kubernetes 2.9 | — |
| Red Hat | Network Observability (NETOBSERV) 1.11.0 | — |
| Red Hat | Network Observability (NETOBSERV) 1.12.2 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | — |
| Red Hat | Red Hat Developer Hub 1.8 | — |
| Red Hat | Red Hat Developer Hub 1.9 | — |
| Red Hat | Red Hat Discovery 2 | — |
| Red Hat | Red Hat Migration Toolkit 1.8 | — |
| Red Hat | Red Hat Migration Toolkit for Applications 8.1 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | — |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | — |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | — |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | — |
| Red Hat | Red Hat Quay 3.10 | — |
| Red Hat | Red Hat Quay 3.12 | — |
| Red Hat | Red Hat Quay 3.14 | — |
| Red Hat | Red Hat Quay 3.15 | — |
| Red Hat | Red Hat Quay 3.16 | — |
| Red Hat | Red Hat Quay 3.17 | — |
| Red Hat | Red Hat Quay 3.18 | — |
| Red Hat | Red Hat Quay 3.9 | — |
| Red Hat | Red Hat Satellite 6.18 | — |
| Red Hat | Red Hat Satellite 6.18 | — |
| Red Hat | Cryostat 4 | — |
| Red Hat | Gatekeeper 3 | — |
| Red Hat | Migration Toolkit for Applications 8 | — |
References
- https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9Exploit, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:16476
- https://access.redhat.com/errata/RHSA-2026:16532
- https://access.redhat.com/errata/RHSA-2026:16534
- https://access.redhat.com/errata/RHSA-2026:16535
- https://access.redhat.com/errata/RHSA-2026:16542
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:17657
- https://access.redhat.com/errata/RHSA-2026:17699
- https://access.redhat.com/errata/RHSA-2026:19109
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24473
- https://access.redhat.com/errata/RHSA-2026:24536
- https://access.redhat.com/errata/RHSA-2026:24539
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/errata/RHSA-2026:25273
- https://access.redhat.com/errata/RHSA-2026:26214
- https://access.redhat.com/errata/RHSA-2026:26225
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:48085
- https://access.redhat.com/errata/RHSA-2026:48670
- https://access.redhat.com/errata/RHSA-2026:50300
- https://access.redhat.com/security/cve/CVE-2026-42039
- https://bugzilla.redhat.com/show_bug.cgi?id=2461630
- https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9Exploit, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json
Timeline
- Published
- Apr 24, 2026
- Last modified
- Nov 11, 2026
- NVD status
- Modified