CVE-2026-42039
EUVD-2026-2560524.04.2026, 18:16
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| axios | axios | 𝑥 < 0.31.1 |
| axios | axios | 1.0.0 ≤ 𝑥 < 1.15.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.1 | 1780917531 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.11.0 | 1780910888 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1778511348 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1778383863 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1778532610 ≤ 𝑥 < * | ADP |
| Red Hat | Network Observability \(NETOBSERV\) 1.11.2 | 1778510461 ≤ 𝑥 < * | ADP |
| Red Hat | Network Observability \(NETOBSERV\) 1.12.0 | 1780920979 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | 1783451729 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | 1780876734 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1780600823 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | 1779371594 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | 1779293013 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1779841586 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1781187342 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1782761244 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1778156756 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit 1.8 | 1780590717 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467029 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467147 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1778645099 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1778539338 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779814592 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1779341289 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | 1778191473 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | 1778191378 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | 1778163785 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | 1778164208 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1778163935 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1778164042 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1778163792 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1778163909 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1778163785 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1778163986 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1779822261 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1779811412 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.14 | 1779689392 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1780891395 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.17 | 1779922205 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1779811473 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1781181673 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1781032495 ≤ 𝑥 < * | ADP |
Debian Releases
Common Weakness Enumeration
- CWE-674 - Uncontrolled RecursionThe product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
References