CVE-2026-42039

EUVD-2026-25605
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
axiosaxios
𝑥
< 0.31.1
axiosaxios
1.0.0 ≤
𝑥
< 1.15.1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red Hatmulticluster engine for Kubernetes 2.1
1780917531 ≤
𝑥
< *
ADP
Red Hatmulticluster engine for Kubernetes 2.11.0
1780910888 ≤
𝑥
< *
ADP
Red Hatmulticluster engine for Kubernetes 2.6
1778511348 ≤
𝑥
< *
ADP
Red Hatmulticluster engine for Kubernetes 2.8
1778383863 ≤
𝑥
< *
ADP
Red Hatmulticluster engine for Kubernetes 2.9
1778532610 ≤
𝑥
< *
ADP
Red HatNetwork Observability \(NETOBSERV\) 1.11.2
1778510461 ≤
𝑥
< *
ADP
Red HatNetwork Observability \(NETOBSERV\) 1.12.0
1780920979 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14
1783451729 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15
1780876734 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16
1780600823 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Security 4.9
1779371594 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10
1779293013 ≤
𝑥
< *
ADP
Red HatRed Hat Developer Hub 1.8
1779841586 ≤
𝑥
< *
ADP
Red HatRed Hat Developer Hub 1.9
1781187342 ≤
𝑥
< *
ADP
Red HatRed Hat Developer Hub 1.9
1782761244 ≤
𝑥
< *
ADP
Red HatRed Hat Discovery 2
1778156756 ≤
𝑥
< *
ADP
Red HatRed Hat Migration Toolkit 1.8
1780590717 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1780467029 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1780467147 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.20
1778645099 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Container Platform 4.21
1778539338 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1779814592 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1779341289 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 2.6
1778191473 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 2.6
1778191378 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.0
1778163785 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.0
1778164208 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.1
1778163935 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.1
1778164042 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.2
1778163792 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.2
1778163909 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.3
1778163785 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Service Mesh 3.3
1778163986 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.1
1779822261 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.12
1779811412 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.14
1779689392 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.15
1780891395 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.16
1779204086 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.17
1779922205 ≤
𝑥
< *
ADP
Red HatRed Hat Quay 3.9
1779811473 ≤
𝑥
< *
ADP
Red HatRed Hat Satellite 6.18
1781181673 ≤
𝑥
< *
ADP
Red HatRed Hat Satellite 6.18
1781032495 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
node-axios
bookworm
no-dsa
bullseye
postponed
forky
1.18.0-1
fixed
sid
1.18.0-1
fixed
trixie
no-dsa
References