GHSA-4ww2-rjh2-xpv9
Record from GitHub Advisory Database · Published August 1, 2026
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kibana-9.1 | Chainguard | 9.1.10-r30 |
| azurite | Chainguard | 3.35.0-r2 |
| jitsucom-jitsu | Wolfi | 2.11.0-r30 |
| langfuse-3 | Wolfi | 3.225.7-r6, 3.223.0-r0 |
| gitlab-rails-ce-fips-19.2 | Chainguard | 19.2.5-r2 |
| gitlab-rails-ce-19.3 | Chainguard | 19.3.1-r6 |
| kibana-8.17 | Chainguard | 8.17.10-r31 |
| nextcloud-server-34 | Chainguard | 34.0.2-r4 |
| wazuh-dashboard-fips | Chainguard | 4.14.7-r1 |
| opensearch-dashboards-2-fips | Chainguard | 2.19.5-r21 |
| kibana-9.3 | Chainguard | 9.3.8-r1 |
| lerna | Wolfi | 9.0.7-r11 |
33 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | kibana-9.1 | 0 |
| chainguard | azurite | 0 |
| wolfi | jitsucom-jitsu | 0 |
| wolfi | langfuse-3 | 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | kibana-8.17 | 0 |
| chainguard | nextcloud-server-34 | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
| chainguard | kibana-9.3 | 0 |
| wolfi | lerna | 0 |
| chainguard | kubeflow-centraldashboard | 0 |
| chainguard | opensearch-dashboards-3-fips | 0 |
| chainguard | langfuse-2 | 0 |
| chainguard | opensearch-dashboards-3 | 0 |
| chainguard | langfuse-3 | 0 |
| chainguard | opensearch-dashboards-2 | 0 |
| chainguard | nextcloud-server-32 | 0 |
| chainguard | arangodb-3.11 | 0 |
…and 25 more
Timeline
- Aug 1, 2026 CVE Published
- Aug 6, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-4ww2-rjh2-xpv9
vulnetix vdb fixes GHSA-4ww2-rjh2-xpv9Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-4ww2-rjh2-xpv9/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart