Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-fq2j-3j99-rx65 (a duplicate of GHSA-42h9-826w-cgv3), describes an uncontrolled recursion issue in the formDataToJSON function within the axios library. Specifically, the buildPath function, which is nested inside formDataToJSON, recursively processes deeply nested bracket segments in FormData field names. The parsePropPath function is responsible for parsing these field names into path segments. In vulnerable versions, neither buildPath nor parsePropPath enforce a maximum recursion depth or path segment limit, allowing an attacker to craft a FormData object with thousands of nested bracket segments. This leads to an exhaustion of the JavaScript call stack, triggering a RangeError: Maximum call stack size exceeded, resulting in a denial of service. The fix involves adding depth checks within these functions to prevent excessive recursion. The identified functions are directly responsible for processing the malicious input and performing the uncontrolled recursive calls.
formDataToJSONlib/helpers/formDataToJSON.js
buildPathlib/helpers/formDataToJSON.js
parsePropPathlib/helpers/formDataToJSON.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 1.0.0, < 1.18.0 |