{"id":"CVE-2026-42039","title":"Axios is a promise based HTTP client for the browser and Node.js","summary":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process wi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674","CWE-770"],"vendor":"axios","product":"axios","affected":["axios < 0.31.1","axios >= 1.0.0, < 1.15.1"],"patched":["axios 1.15.1"],"published":"2026-04-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:03.880","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16476","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16532","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16534","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16535","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16542","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16874","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17468","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17474","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17657","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17699","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19109","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22619","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24473","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24536","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25041","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25271","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:25273","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26214","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26225","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48670","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42039","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461630","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42039"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-04-24T18:14:11.509943Z"},"scores":{"nvd":7.5,"cna":6.9,"vendor":7.5},"epss":0.00744,"epssPercentile":0.53298,"ingestedAt":"2026-07-01T15:50:58.787Z","slug":"CVE-2026-42039","body":"## Overview\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\n## Affected\n\n- `axios < 0.31.1`\n- `axios >= 1.0.0, < 1.15.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `axios 1.15.1`\n\n## Vendor advisories\n\n- **RHSA-2026:25089** · Red Hat · fixed in: HawtIO HawtIO 4.4.0 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25089)\n- **RHSA-2026:16874** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.11.0 · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:16874)\n- **RHSA-2026:24473** · Red Hat · fixed in: Network Observability (NETOBSERV) 1.12.2 · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24473)\n- **RHSA-2026:36882** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36882)\n- **RHSA-2026:24539** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24539)\n- **RHSA-2026:25273** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:25273)\n- **RHSA-2026:20938** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20938)\n- **RHSA-2026:20889** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20889)\n- **RHSA-2026:22619** · Red Hat · fixed in: Red Hat Data Grid 8.6.1 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22619)\n- **RHSA-2026:21338** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21338)\n- **RHSA-2026:33574** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33574)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Network Observability Operator, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Enterprise Linux 8, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201633,"id":"CVE-2026-42039","ts":1789399576787,"field":"exploit_available","old":"false","new":"true"},{"seq":200365,"id":"CVE-2026-42039","ts":1789397169591,"field":"exploit_available","old":"true","new":"false"},{"seq":198289,"id":"CVE-2026-42039","ts":1789391801594,"field":"exploit_available","old":"false","new":"true"},{"seq":196082,"id":"CVE-2026-42039","ts":1789383452520,"field":"exploit_available","old":"true","new":"false"},{"seq":195011,"id":"CVE-2026-42039","ts":1789380345666,"field":"exploit_available","old":"false","new":"true"},{"seq":193798,"id":"CVE-2026-42039","ts":1789378318614,"field":"exploit_available","old":"true","new":"false"},{"seq":192585,"id":"CVE-2026-42039","ts":1789376290018,"field":"exploit_available","old":"false","new":"true"},{"seq":191372,"id":"CVE-2026-42039","ts":1789373201188,"field":"exploit_available","old":"true","new":"false"},{"seq":190157,"id":"CVE-2026-42039","ts":1789369182148,"field":"exploit_available","old":"false","new":"true"},{"seq":188944,"id":"CVE-2026-42039","ts":1789368067921,"field":"exploit_available","old":"true","new":"false"},{"seq":187727,"id":"CVE-2026-42039","ts":1789365039345,"field":"exploit_available","old":"false","new":"true"},{"seq":186514,"id":"CVE-2026-42039","ts":1789363060245,"field":"exploit_available","old":"true","new":"false"},{"seq":185300,"id":"CVE-2026-42039","ts":1789360997116,"field":"exploit_available","old":"false","new":"true"},{"seq":184087,"id":"CVE-2026-42039","ts":1789357990690,"field":"exploit_available","old":"true","new":"false"},{"seq":182339,"id":"CVE-2026-42039","ts":1789354138375,"field":"exploit_available","old":"false","new":"true"},{"seq":181132,"id":"CVE-2026-42039","ts":1789352987258,"field":"exploit_available","old":"true","new":"false"},{"seq":179925,"id":"CVE-2026-42039","ts":1789350050255,"field":"exploit_available","old":"false","new":"true"},{"seq":178718,"id":"CVE-2026-42039","ts":1789347903234,"field":"exploit_available","old":"true","new":"false"},{"seq":177511,"id":"CVE-2026-42039","ts":1789346204436,"field":"exploit_available","old":"false","new":"true"},{"seq":176304,"id":"CVE-2026-42039","ts":1789342806444,"field":"exploit_available","old":"true","new":"false"},{"seq":175758,"id":"CVE-2026-42039","ts":1789338593222,"field":"exploit_available","old":"false","new":"true"},{"seq":175628,"id":"CVE-2026-42039","ts":1789338431146,"field":"exploit_available","old":"true","new":"false"},{"seq":174423,"id":"CVE-2026-42039","ts":1789334637465,"field":"exploit_available","old":"false","new":"true"},{"seq":173218,"id":"CVE-2026-42039","ts":1789333301041,"field":"exploit_available","old":"true","new":"false"},{"seq":172032,"id":"CVE-2026-42039","ts":1789330923491,"field":"exploit_available","old":"false","new":"true"},{"seq":170846,"id":"CVE-2026-42039","ts":1789328429892,"field":"exploit_available","old":"true","new":"false"},{"seq":169641,"id":"CVE-2026-42039","ts":1789326947512,"field":"exploit_available","old":"false","new":"true"},{"seq":168436,"id":"CVE-2026-42039","ts":1789323500402,"field":"exploit_available","old":"true","new":"false"},{"seq":167231,"id":"CVE-2026-42039","ts":1789319409026,"field":"exploit_available","old":"false","new":"true"},{"seq":166026,"id":"CVE-2026-42039","ts":1789318358448,"field":"exploit_available","old":"true","new":"false"},{"seq":164821,"id":"CVE-2026-42039","ts":1789315583609,"field":"exploit_available","old":"false","new":"true"},{"seq":163616,"id":"CVE-2026-42039","ts":1789313298684,"field":"exploit_available","old":"true","new":"false"},{"seq":162411,"id":"CVE-2026-42039","ts":1789311737046,"field":"exploit_available","old":"false","new":"true"},{"seq":161206,"id":"CVE-2026-42039","ts":1789308320770,"field":"exploit_available","old":"true","new":"false"},{"seq":160711,"id":"CVE-2026-42039","ts":1789304248639,"field":"exploit_available","old":"false","new":"true"},{"seq":158549,"id":"CVE-2026-42039","ts":1789299338324,"field":"exploit_available","old":"true","new":"false"},{"seq":157513,"id":"CVE-2026-42039","ts":1789296489516,"field":"exploit_available","old":"false","new":"true"},{"seq":156308,"id":"CVE-2026-42039","ts":1789294427738,"field":"exploit_available","old":"true","new":"false"},{"seq":155103,"id":"CVE-2026-42039","ts":1789292685234,"field":"exploit_available","old":"false","new":"true"},{"seq":153898,"id":"CVE-2026-42039","ts":1789289411237,"field":"exploit_available","old":"true","new":"false"},{"seq":152548,"id":"CVE-2026-42039","ts":1789281292607,"field":"exploit_available","old":"false","new":"true"},{"seq":148044,"id":"CVE-2026-42039","ts":1789270922818,"field":"exploit_available","old":"true","new":"false"},{"seq":146084,"id":"CVE-2026-42039","ts":1789269198484,"field":"exploit_available","old":"false","new":"true"},{"seq":144987,"id":"CVE-2026-42039","ts":1789266155623,"field":"exploit_available","old":"true","new":"false"},{"seq":143891,"id":"CVE-2026-42039","ts":1789262491376,"field":"exploit_available","old":"false","new":"true"},{"seq":142727,"id":"CVE-2026-42039","ts":1789261243118,"field":"exploit_available","old":"true","new":"false"},{"seq":141563,"id":"CVE-2026-42039","ts":1789258644489,"field":"exploit_available","old":"false","new":"true"},{"seq":140365,"id":"CVE-2026-42039","ts":1789256445555,"field":"exploit_available","old":"true","new":"false"},{"seq":139167,"id":"CVE-2026-42039","ts":1789254624741,"field":"exploit_available","old":"false","new":"true"},{"seq":137969,"id":"CVE-2026-42039","ts":1789251625015,"field":"exploit_available","old":"true","new":"false"}]}