CVE-2026-42039

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.1%
Exploitation probability in 30 days
Top 78% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Published: April 24, 2026 (76 days ago)
Last Modified: April 24, 2026
Vendor: Red Hat
Fix Available: ✓ Yes
Source: REDHAT

Description

A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the `toFormData` function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js process to crash due to a RangeError, leading to a potential Denial of Service (DoS) if the process crashes.

CWE

CWE-770

Affected Products

Cryostat 4Gatekeeper 3Migration Toolkit for Applications 8Migration Toolkit for ContainersNetwork Observability OperatorOpenShift PipelinesOpenShift Service Mesh 3Red Hat 3scale API Management Platform 2Red Hat Advanced Cluster Management for Kubernetes 2Red Hat Ansible Automation Platform 2

Fix Status

✅ Fix Available

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com