Came across something in package-lock.json around line 2584 that looked worth flagging.
The project depends on axios 1.13.5, which is affected by CVE-2026-42039, a Denial-of-Service vulnerability. Axios's internal toFormData helper recursively walks nested objects passed as request data without any depth limit. If an attacker can control the structure of a payload that is forwarded via an axios request (e.g., passing user-supplied JSON directly into axios.post()), a sufficiently deep nesting level exceeds the JavaScript call stack and throws 'RangeError: Maximum call stack size exceeded', crashing the entire Node.js process. Impact is availability loss (process crash, potential crash-loop); there is no confidentiality or integrity impact. Exploitability depends on whether untrusted, attacker-controlled nested objects reach axios request bodies — internet-facing APIs that relay client JSON are directly exposed. Risk: Medium overall, High for services accepting arbitrary client payloads. Recommended fix: upgrade axios to >= 1.15.1 (or >= 0.31.1 on the 0.x line), which adds a depth limit to toFormData. As defense-in-depth, validate and cap payload nesting depth before serializing untrusted data into requests.
Something like this might fix it:
Upgrade the axios dependency and regenerate the lockfile:
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@
- "axios": "1.13.5"
+ "axios": "^1.15.1"
Then run:
npm install axios@^1.15.1
This regenerates package-lock.json and resolves the vulnerable entry (lines 2584-2594).
Resulting lockfile update:
diff --git a/package-lock.json b/package-lock.json
--- a/package-lock.json
+++ b/package-lock.json
@@
"node_modules/axios": {
- "version": "1.13.5",
+ "version": "1.15.1",
If an immediate upgrade is not possible, mitigate by rejecting deeply nested payloads before passing them to axios:
function assertMaxDepth(value, maxDepth = 50, currentDepth = 0) {
if (currentDepth > maxDepth) {
throw new Error('Request payload nesting depth exceeds allowed limit');
}
if (value && typeof value === 'object') {
for (const v of Object.values(value)) {
assertMaxDepth(v, maxDepth, currentDepth + 1);
}
}
}
// Before forwarding untrusted data:
assertMaxDepth(req.body);
axios.post('/api/upstream', req.body);For reference: rule CVE-2026-42039. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
package-lock.jsonaround line 2584 that looked worth flagging.The project depends on axios 1.13.5, which is affected by CVE-2026-42039, a Denial-of-Service vulnerability. Axios's internal toFormData helper recursively walks nested objects passed as request data without any depth limit. If an attacker can control the structure of a payload that is forwarded via an axios request (e.g., passing user-supplied JSON directly into axios.post()), a sufficiently deep nesting level exceeds the JavaScript call stack and throws 'RangeError: Maximum call stack size exceeded', crashing the entire Node.js process. Impact is availability loss (process crash, potential crash-loop); there is no confidentiality or integrity impact. Exploitability depends on whether untrusted, attacker-controlled nested objects reach axios request bodies — internet-facing APIs that relay client JSON are directly exposed. Risk: Medium overall, High for services accepting arbitrary client payloads. Recommended fix: upgrade axios to >= 1.15.1 (or >= 0.31.1 on the 0.x line), which adds a depth limit to toFormData. As defense-in-depth, validate and cap payload nesting depth before serializing untrusted data into requests.
Something like this might fix it:
For reference: rule
CVE-2026-42039. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.