Home / Vulnerability Intelligence / CVE-2026-42039

CVE-2026-42039 - Vulnerability Analysis

HighCVSS: 7.5

Last Updated: April 27, 2026

Axios - Denial of Service

Published: April 24, 2026Updated: April 27, 2026PoC AvailableRemote Exploitable

Overview

Axios < 1.15.1 and < 0.31.1 contains a denial of service caused by unbounded recursion in toFormData when processing deeply nested objects, letting attackers crash the Node.js process remotely, exploit requires crafted request data.

Severity & Score

Severity: High

CVSS Score: 7.5

Impact

Attackers can crash the Node.js process causing denial of service.

Mitigation

Update to version 1.15.1 or 0.31.1 or later.

References

https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-42039
Severity: High
CVSS Score: 7.5
Type: denial_of_service
Status: confirmed

CWE

CWE-674

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H