6.9
Medium
CVE-2026-42039 Axios is a promise based HTTP client for the browser and Node.js
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| axios 1.0 | 1.0.0 → < 1.15.1 | 1.15.1 |
| axios 0.31 | earliest → < 0.31.1 | 0.31.1 |
| HawtIO HawtIO 4.4.0 | Versions not published | |
| Network Observability (NETOBSERV) 1.11.2 1778510461 | earliest → < 1778510461 | 1778510461 |
| Network Observability (NETOBSERV) 1.12.0 1780920979 | earliest → < 1780920979 | 1780920979 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1780876734 | earliest → < 1780876734 | 1780876734 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1779293013 | earliest → < 1779293013 | 1779293013 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
Show the 69 other branches Hide the 69 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Data Grid 8.6.1 | Versions not published | |
| Red Hat Developer Hub 1.8 1779841586 | earliest → < 1779841586 | 1779841586 |
| Red Hat Developer Hub 1.9 1782761244 | earliest → < 1782761244 | 1782761244 |
| Red Hat Discovery 2 1778156756 | earliest → < 1778156756 | 1778156756 |
| Red Hat Migration Toolkit 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift AI 2.25 1780467147 | earliest → < 1780467147 | 1780467147 |
| Red Hat OpenShift Container Platform 4.20 1778645099 | earliest → < 1778645099 | 1778645099 |
| Red Hat OpenShift Container Platform 4.21 1785354128 | earliest → < 1785354128 | 1785354128 |
| Red Hat OpenShift Dev Spaces 3.28 1779341289 | earliest → < 1779341289 | 1779341289 |
| Red Hat OpenShift Service Mesh 2.6 1778191378 | earliest → < 1778191378 | 1778191378 |
| Red Hat OpenShift Service Mesh 3.0 1778164208 | earliest → < 1778164208 | 1778164208 |
| Red Hat OpenShift Service Mesh 3.1 1778164042 | earliest → < 1778164042 | 1778164042 |
| Red Hat OpenShift Service Mesh 3.2 1778163909 | earliest → < 1778163909 | 1778163909 |
| Red Hat OpenShift Service Mesh 3.3 1778163986 | earliest → < 1778163986 | 1778163986 |
| Red Hat Quay 3.12 1779811412 | earliest → < 1779811412 | 1779811412 |
| Red Hat Quay 3.14 1779689392 | earliest → < 1779689392 | 1779689392 |
| Red Hat Quay 3.15 1780891395 | earliest → < 1780891395 | 1780891395 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.17 1779922205 | earliest → < 1779922205 | 1779922205 |
| Red Hat Quay 3.1 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Quay 3.9 1779811473 | earliest → < 1779811473 | 1779811473 |
| Red Hat Satellite 6.18 1781032495 | earliest → < 1781032495 | 1781032495 |
| multicluster engine for Kubernetes 2.10 1780917531 | earliest → < 1780917531 | 1780917531 |
| multicluster engine for Kubernetes 2.11 1780910888 | earliest → < 1780910888 | 1780910888 |
| multicluster engine for Kubernetes 2.6 1778511348 | earliest → < 1778511348 | 1778511348 |
| multicluster engine for Kubernetes 2.8 1778383863 | earliest → < 1778383863 | 1778383863 |
| multicluster engine for Kubernetes 2.9 1778532610 | earliest → < 1778532610 | 1778532610 |
| Migration Toolkit for Applications 8 | Versions not published | |
| Network Observability Operator | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Hardened Images | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat Quay 3.10 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 | earliest → < 1783451729 | 1783451729 |
| Red Hat OpenShift Service Mesh 3 1778164208 | earliest → < 1778164208 | 1778164208 |
| Network Observability (NETOBSERV) 1.12.1 1780920979 | earliest → < 1780920979 | 1780920979 |
| multicluster engine for Kubernetes 2.1 1780917531 | earliest → < 1780917531 | 1780917531 |
| multicluster engine for Kubernetes 2.11.0 1780910888 | earliest → < 1780910888 | 1780910888 |
| Red Hat Advanced Cluster Security 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Migration Toolkit for Containers 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift Container Platform 4.2 1778645099 | earliest → < 1778645099 | 1778645099 |
| multicluster engine for Kubernetes 2.9.0 1778532610 | earliest → < 1778532610 | 1778532610 |
| Network Observability (NETOBSERV) 1.11.1 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16.0 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Quay 3.18 1784987273 | earliest → < 1784987273 | 1784987273 |
| Network Observability (NETOBSERV) 1.11.0 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Migration Toolkit for Applications 8.1 1785169013 | earliest → < 1785169013 | 1785169013 |
| Network Observability (NETOBSERV) 1.12.2 1780920979 | earliest → < 1780920979 | 1780920979 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of axios
The 53 CVEs of axios →
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js
8.3
High
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js
7.0
High