{"id":"EUVD-2026-25605","revision":null,"records":[{"revision":"63b8186913204f7db2881731954c4255","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42039","aliases":[],"title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","state":0,"publishedAt":"2026-04-24T18:01:30.775+00:00","modifiedAt":"2026-09-10T12:04:56.504+00:00","affected":[{"ecosystem":"Vendor product","name":"axios","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"axios\",\n                    \"product\": \"axios\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 1.15.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 0.31.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42039","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42039","identifiers":["CVE-2026-42039"]},"retained":false,"historicalAffected":[]},{"revision":"5b238800aa8349b1a2b48c643710b5ac","observedAt":"2026-11-13T12:01:43.594+00:00","statement":{"source":"euvd","id":"EUVD-2026-25605","aliases":["CVE-2026-42039"],"title":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with …","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25605","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 24, 2026, 6:01:30 PM","dateUpdated":"Sep 10, 2026, 12:04:56 PM"},"relatedAdvisories":[{"id":"RHSA-2026:26225","title":"Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-6322","CVE-2026-9277","CVE-2026-26996","CVE-2026-27904","CVE-2026-29063","CVE-2026-41680","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16476","title":"Red Hat Security Advisory: Kiali 1.73.30 for Red Hat OpenShift Service Mesh 2.6","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:24853","title":"Red Hat Security Advisory: Red Hat Quay 3.15.5","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-25679","CVE-2026-27459","CVE-2026-27962","CVE-2026-32280","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]},{"id":"RHSA-2026:16874","title":"Red Hat Security Advisory: Network Observability 1.11.2 for OpenShift","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69873","CVE-2026-4800","CVE-2026-25679","CVE-2026-32280","CVE-2026-32282","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:22619","title":"Red Hat Security Advisory: Red Hat Data Grid 8.6.1 security update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-33870","CVE-2026-33871","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:25273","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.2 security update","vulnerabilityIds":["CVE-2025-48431","CVE-2026-6322","CVE-2026-33815","CVE-2026-33816","CVE-2026-40895","CVE-2026-41602","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-43869"]},{"id":"RHSA-2026:48670","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.27 bug fix and security update","vulnerabilityIds":["CVE-2026-16242","CVE-2026-42033","CVE-2026-42039","CVE-2026-42043","CVE-2026-49978"]},{"id":"RHSA-2026:22465","title":"Red Hat Security Advisory: Red Hat Quay 3.17.2","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4427","CVE-2026-27459","CVE-2026-29063","CVE-2026-29074","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33747","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:17474","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.16 bug fix and security update","vulnerabilityIds":["CVE-2026-22029","CVE-2026-33186","CVE-2026-34043","CVE-2026-34986","CVE-2026-40175","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"WID-SEC-W-2026-1513","title":"Kiali für Red Hat OpenShift Service Mesh (Axios, Go, Follow-redirects): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-32280","CVE-2026-40895"]},{"id":"RHSA-2026:22629","title":"Red Hat Security Advisory: Red Hat Quay 3.12.18","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:22840","title":"Red Hat Security Advisory: Red Hat Quay 3.10.22","vulnerabilityIds":["CVE-2025-62718","CVE-2026-2377","CVE-2026-4598","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16534","title":"Red Hat Security Advisory: Kiali 2.4.16 for Red Hat OpenShift Service Mesh 3.0","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:17468","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.23 bug fix and security update","vulnerabilityIds":["CVE-2025-61726","CVE-2026-4800","CVE-2026-22029","CVE-2026-33186","CVE-2026-34043","CVE-2026-34986","CVE-2026-35469","CVE-2026-40175","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:50300","title":"Red Hat Security Advisory: Migration Toolkit for Applications","vulnerabilityIds":["CVE-2026-4926","CVE-2026-12143","CVE-2026-13149","CVE-2026-25681","CVE-2026-26996","CVE-2026-27136","CVE-2026-27904","CVE-2026-33811","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42039","CVE-2026-42041","CVE-2026-42044","CVE-2026-42264","CVE-2026-42342","CVE-2026-42499","CVE-2026-42504","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-55603"]},{"id":"RHSA-2026:24536","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.3 security update","vulnerabilityIds":["CVE-2026-33186","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:17699","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.6 security update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:21772","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.0 Release.","vulnerabilityIds":["CVE-2025-14813","CVE-2025-68121","CVE-2026-0636","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-1605","CVE-2026-2229","CVE-2026-2327","CVE-2026-5588","CVE-2026-26996","CVE-2026-27904","CVE-2026-29074","CVE-2026-30827","CVE-2026-31802","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-32305","CVE-2026-33252","CVE-2026-33810","CVE-2026-34742","CVE-2026-35051","CVE-2026-39858","CVE-2026-40477","CVE-2026-40478","CVE-2026-40611","CVE-2026-40895","CVE-2026-40912","CVE-2026-40972","CVE-2026-40973","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:19375","title":"Red Hat Security Advisory: Red Hat Quay 3.16.4","vulnerabilityIds":["CVE-2025-61726","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-4598","CVE-2026-4599","CVE-2026-4600","CVE-2026-4601","CVE-2026-4602","CVE-2026-25679","CVE-2026-27137","CVE-2026-27459","CVE-2026-27962","CVE-2026-28802","CVE-2026-29063","CVE-2026-29074","CVE-2026-30922","CVE-2026-32280","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-32597","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:20889","title":"Red Hat Security Advisory: RHACS 4.10.3 security and bug fix update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-25679","CVE-2026-32280","CVE-2026-32281","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42264","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:26214","title":"Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image","vulnerabilityIds":["CVE-2025-69873","CVE-2026-6321","CVE-2026-26996","CVE-2026-27904","CVE-2026-41680","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:14937","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4424","CVE-2026-4878","CVE-2026-5121","CVE-2026-27135","CVE-2026-28390","CVE-2026-35385","CVE-2026-35386","CVE-2026-35387","CVE-2026-35388","CVE-2026-35414","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:21017","title":"Red Hat Security Advisory: Red Hat Quay 3.14.8","vulnerabilityIds":["CVE-2025-61726","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-25679","CVE-2026-27459","CVE-2026-29074","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:19109","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.4 security update","vulnerabilityIds":["CVE-2026-33186","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:36882","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update","vulnerabilityIds":["CVE-2025-13465","CVE-2025-47907","CVE-2025-48431","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-62718","CVE-2026-22029","CVE-2026-22610","CVE-2026-25639","CVE-2026-25681","CVE-2026-29063","CVE-2026-32285","CVE-2026-33186","CVE-2026-33487","CVE-2026-40175","CVE-2026-40293","CVE-2026-40895","CVE-2026-41602","CVE-2026-41603","CVE-2026-41604","CVE-2026-41605","CVE-2026-41606","CVE-2026-41607","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-43869","CVE-2026-43870","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990"]},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45339","CVE-2025-13465","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-24358","CVE-2025-47911","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2025-5889","CVE-2025-64718","CVE-2025-6545","CVE-2025-6547","CVE-2025-7783","CVE-2026-1229","CVE-2026-25128","CVE-2026-25680","CVE-2026-25681","CVE-2026-26278","CVE-2026-26996","CVE-2026-27136","CVE-2026-2739","CVE-2026-27606","CVE-2026-27904","CVE-2026-33036","CVE-2026-33186","CVE-2026-33487","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-42039","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"RHSA-2026:48085","title":"Red Hat Security Advisory: Red Hat Quay 3.18.0","vulnerabilityIds":["CVE-2026-4427","CVE-2026-27459","CVE-2026-27962","CVE-2026-29063","CVE-2026-29074","CVE-2026-32590","CVE-2026-32591","CVE-2026-34986","CVE-2026-42039","CVE-2026-48526","CVE-2026-73086"]},{"id":"RHSA-2026:21338","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.7 release.","vulnerabilityIds":["CVE-2026-6321","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-40895","CVE-2026-41240","CVE-2026-41242","CVE-2026-41674","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:20938","title":"Red Hat Security Advisory: RHACS 4.9.7 security and bug fix update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-32281","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42264","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:24473","title":"Red Hat Security Advisory: Network Observability 1.12.0 for OpenShift","vulnerabilityIds":["CVE-2026-6321","CVE-2026-29063","CVE-2026-32281","CVE-2026-42039","CVE-2026-42044"]},{"id":"RHSA-2026:25271","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.0 General Availability","vulnerabilityIds":["CVE-2026-6322","CVE-2026-29181","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:25089","title":"Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.","vulnerabilityIds":["CVE-2025-13465","CVE-2025-61726","CVE-2025-61729","CVE-2026-1002","CVE-2026-1605","CVE-2026-2332","CVE-2026-5795","CVE-2026-6321","CVE-2026-22731","CVE-2026-24400","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-33810","CVE-2026-34478","CVE-2026-34480","CVE-2026-39852","CVE-2026-40972","CVE-2026-40973","CVE-2026-40975","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16532","title":"Red Hat Security Advisory: Kiali 2.11.10 for Red Hat OpenShift Service Mesh 3.1","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:24539","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update","vulnerabilityIds":["CVE-2025-48431","CVE-2026-33815","CVE-2026-33816","CVE-2026-40293","CVE-2026-40890","CVE-2026-40895","CVE-2026-41602","CVE-2026-41603","CVE-2026-41604","CVE-2026-41605","CVE-2026-41606","CVE-2026-41607","CVE-2026-41636","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-43869"]},{"id":"RHSA-2026:25041","title":"Red Hat Security Advisory: Red Hat Migration Toolkit for Containers","vulnerabilityIds":["CVE-2026-25639","CVE-2026-40175","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16535","title":"Red Hat Security Advisory: Kiali 2.17.7 for Red Hat OpenShift Service Mesh 3.2","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:17657","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.11 security update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:33574","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.","vulnerabilityIds":["CVE-2026-9277","CVE-2026-9673","CVE-2026-27145","CVE-2026-33811","CVE-2026-39820","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44724","CVE-2026-45736","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47208","CVE-2026-47209","CVE-2026-48779"]},{"id":"RHSA-2026:24977","title":"Red Hat Security Advisory: RHOAI 2.25.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-14813","CVE-2025-48956","CVE-2025-61726","CVE-2025-62718","CVE-2025-69227","CVE-2025-69228","CVE-2026-1462","CVE-2026-4800","CVE-2026-6321","CVE-2026-23490","CVE-2026-24747","CVE-2026-25048","CVE-2026-25960","CVE-2026-27489","CVE-2026-27893","CVE-2026-28500","CVE-2026-28684","CVE-2026-29063","CVE-2026-29074","CVE-2026-31958","CVE-2026-32280","CVE-2026-32597","CVE-2026-32981","CVE-2026-33186","CVE-2026-33231","CVE-2026-34986","CVE-2026-34993","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-41240","CVE-2026-41242","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:23361","title":"Red Hat Security Advisory: Red Hat Quay 3.9.22","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61728","CVE-2025-62718","CVE-2026-2377","CVE-2026-4427","CVE-2026-4598","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32589","CVE-2026-32590","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16542","title":"Red Hat Security Advisory: Kiali 2.22.3 for Red Hat OpenShift Service Mesh 3.3","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25605","identifiers":["EUVD-2026-25605","CVE-2026-42039"]},"retained":false,"historicalAffected":[]},{"revision":"bd6c5019eb124dd3b368071b2be595d7","observedAt":"2026-11-12T16:19:25.974+00:00","statement":{"source":"nvd","id":"CVE-2026-42039","aliases":[],"title":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with …","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.","state":0,"publishedAt":"2026-04-24T18:16:30.827+00:00","modifiedAt":"2026-11-11T23:10:00.263+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17657","https://access.redhat.com/errata/RHSA-2026:17699","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24473","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25041","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:25273","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:26225","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/errata/RHSA-2026:48670","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/security/cve/CVE-2026-42039","https://bugzilla.redhat.com/show_bug.cgi?id=2461630","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42039.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-674","CWE-770"],"productCriteria":["cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-24T18:16:30.827","lastModified":"2026-11-11T23:10:00.263"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42039","identifiers":["CVE-2026-42039"]},"retained":false,"historicalAffected":[]},{"revision":"bf45df8b8e3840b593c0936d5632ea20","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-62hf-57xw-28j9","aliases":["CVE-2026-42039"],"title":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","description":"### Summary\ntoFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError.\n\n### Details\nlib/helpers/toFormData.js:210 defines an inner `build(value, path)` that recurses into every object/array child (line 225: `build(el, path ? path.concat(key) : [key])`). The only safeguard is a `stack` array used to detect circular references; there is no maximum depth and no try/catch around the recursion. Because `build` calls itself once per nesting level, a payload nested roughly 2000+ levels deep exhausts V8's call stack.\n\n`toFormData` is the serializer behind `FormData` request bodies and `AxiosURLSearchParams` (used by `buildURL` when `params` is an object with `URLSearchParams` unavailable, see `lib/helpers/buildURL.js:53` and `lib/helpers/AxiosURLSearchParams.js:36`). Any server-side code that forwards a client-supplied object into `axios({ data, params })` therefore reaches the recursive walker with attacker-controlled depth.\n\nThe RangeError is thrown synchronously from inside `forEach`, escapes `toFormData`, and propagates out of the axios request call. In typical Express/Fastify request handlers this terminates the running request; in synchronous startup paths or worker threads it can crash the whole process.\n\n### PoC\n```js\nimport toFormData from 'axios/lib/helpers/toFormData.js';\nimport FormData from 'form-data';\n\nfunction nest(depth) {\n  let o = { leaf: 1 };\n  for (let i = 0; i < depth; i++) o = { a: o };\n  return o;\n}\n\ntry {\n  toFormData(nest(2500), new FormData());\n} catch (e) {\n  console.log(e.name + ': ' + e.message);\n}\n// RangeError: Maximum call stack size exceeded\n```\n\nServer-side reachability example:\n```js\n// vulnerable proxy pattern\napp.post('/forward', async (req, res) => {\n  await axios.post('https://upstream/api', req.body); // req.body user-controlled\n  res.send('ok');\n});\n// attacker POST /forward with {\"a\":{\"a\":{\"a\":... 2500 deep ...}}}\n// -> toFormData build() overflows -> request handler crashes\n```\n\nVerified on axios 1.15.0 (latest, 2026-04-10), Node.js 20, 3/3 PoC runs reproduce the RangeError at depth 2500.\n\n### Impact\nA remote, unauthenticated attacker who can influence an object passed to axios as request `data` or `params` triggers an uncaught RangeError inside the synchronous recursive walker. In server-side applications that proxy or re-send client JSON through axios this crashes the request handler and, in worker/cluster setups, the process. Fix by bounding recursion depth in `toFormData`'s `build` function (reject or throw on depths beyond a configurable limit, e.g. 100) or rewriting the walker iteratively.","state":0,"publishedAt":"2026-05-05T00:34:32+00:00","modifiedAt":"2026-09-10T03:50:45.7037896+00:00","affected":[{"ecosystem":"npm","name":"axios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.15.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"axios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.31.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9","https://nvd.nist.gov/vuln/detail/CVE-2026-42039","https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f","https://github.com/axios/axios","https://github.com/axios/axios/releases/tag/v1.15.1"],"sourceUrl":"https://github.com/advisories/GHSA-62hf-57xw-28j9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-62hf-57xw-28j9","identifiers":["GHSA-62hf-57xw-28j9","CVE-2026-42039"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5204338+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5204347+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-576973bd2a8c36ed3d013750ca82fcede7b10fe95f071dbe9a6a4dd94759ab84","complete":true,"records":425782,"lastAttemptAt":"2026-11-15T07:30:53.2515651+00:00","lastSuccessAt":"2026-11-15T07:30:53.2350398+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.2515651+00:00","snapshotPublishedAt":"2026-11-15T07:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-51c4fdbdf1b54dc7b4fe83e6e1ed4b96","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T07:46:53.2479496+00:00","lastSuccessAt":"2026-11-15T07:46:53.241+00:00","error":"82 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T07:46:53.241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13488,"expectedIdentifiers":13874,"failedIdentifiers":82},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T07:30:54.3562129+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T07:30:54.3562129+00:00","lastSuccessAt":"2026-11-15T07:30:54.5213705+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.5213739+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35abf047bdfe46089a52c4c139c37942","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T07:31:01.665293+00:00","lastSuccessAt":"2026-11-15T05:33:23.837+00:00","error":"12 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T05:33:23.837+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13862,"expectedIdentifiers":13874,"failedIdentifiers":12},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T07:30:53.9403022+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.9403022+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T07:30:53.3921516+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.3921516+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T07:30:54.2664324+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:54.2664324+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-878f718ccd076f540460423958c8e379b139b997b45858275573ecc4d702fe9a","complete":true,"records":232474,"lastAttemptAt":"2026-11-15T07:30:53.7776854+00:00","lastSuccessAt":"2026-11-15T05:33:06.8241102+00:00","error":null,"lastVerifiedAt":"2026-11-15T07:30:53.7776854+00:00","snapshotPublishedAt":"2026-11-15T04:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}