GHSA-42h9-826w-cgv3

## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type. Applications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: Maximum call stack size exceeded`, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination. ## Impact The impact is denial of service against applications that process untrusted `FormData` field names through axios' FormData-to-JSON conversion. The vulnerable path is not reached by merely installing axios, by normal multipart `FormData` pass-through, or by ordinary axios requests that do not request JSON serialisation of `FormData`. In the default axios request, the error is produced before network I/O and returned as a rejected Promise. Direct use of `formToJSON()` throws synchronously. Server-side applications are the primary risk when remote users can submit arbitrary form field names, and the application converts those fields with `formToJSON()` or sends them through axios as JSON. ## Affected Functionality Affected APIs and paths: - `axios.formToJSON(formData)` - `import { formToJSON } from "axios"` - `lib/helpers/formDataToJSON.js` - axios default `transformRequest` when `data` is `FormData` and `Content-Type` contains `application/json` Unaffected or lower-risk paths: - Normal multipart `FormData` requests without `JSON Content-Type` - `toFormData()` object-to-FormData serialisation, which already has a `maxDepth` guard - Axios versions before 0.28.0, where this helper and public API were not present ## Technical Details `lib/helpers/formDataToJSON.js` parses a form field name into path segme