CVE
CVE-2026-42039
0field notes · 1digest CVSS 7.5
Daily digests
An attacker can crash any Node.js service that passes user-supplied data through Axios's toFormData helper by sending deeply nested objects that trigger unbounded recursion. The server runs out of stack space and dies, giving you a straightforward denial-of-service. No authentication or special access is required if your API accepts arbitrary JSON bodies.