Uncontrolled Recursion in axios - CVE-2026-42039
Published: April 24, 2026
Vulnerability identifier: #VU127598
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42039
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in toFormData in lib/helpers/toFormData.js when processing deeply nested request data or params objects. A remote attacker can send a deeply nested object to cause a denial of service.
The issue can be reached in server-side code that forwards client-controlled objects into axios request data or params, and may terminate the running request handler or process with a RangeError.
Affected software
axios
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
JBoss Data Grid
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
JBoss Data Grid
How to mitigate CVE-2026-42039
Install security update from vendor's website.
axios - addressed in versions 0.31.1, 1.15.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
JBoss Data Grid - update to 8.6.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
JBoss Data Grid - update to 8.6.1