{"id":"dde2d59fa08addf2","repo":"axios/axios","slug":"err-form-data-depth-exceeded","errorCode":"ERR_FORM_DATA_DEPTH_EXCEEDED","errorMessage":"FormData field is too deeply nested (${index} levels). Max depth: ${MAX_DEPTH}","messagePattern":"FormData field is too deeply nested \\((.+?) levels\\)\\. Max depth: (.+?)","errorType":"exception","errorClass":"AxiosError","httpStatus":null,"severity":"error","filePath":"lib/helpers/formDataToJSON.js","lineNumber":11,"sourceCode":"'use strict';\n\nimport utils from '../utils.js';\nimport AxiosError from '../core/AxiosError.js';\nimport { DEFAULT_FORM_DATA_MAX_DEPTH } from './toFormData.js';\n\nconst MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;\n\nfunction throwIfDepthExceeded(index) {\n  if (index > MAX_DEPTH) {\n    throw new AxiosError(\n      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,\n      AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED\n    );\n  }\n}\n\n/**\n * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']\n *\n * @param {string} name - The name of the property to get.\n *\n * @returns An array of strings.\n */\nfunction parsePropPath(name) {\n  // foo[x][y][z] -> ['foo', 'x', 'y', 'z']\n  // foo.x.y.z    -> ['foo', 'x', 'y', 'z']\n  // A path is split on `.` and on `[...]` groups. A segment — whether written\n  // in dot notation or captured inside brackets — may contain any character","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/axios/axios/blob/c3f553c740ebf3dff5e22dae24e9caaafafddd2d/lib/helpers/formDataToJSON.js#L1-L29","documentation":"Thrown while converting multipart FormData back into a JSON object (lib/helpers/formDataToJSON.js:9-15): field names like `a[b][c]` are parsed into property paths, and if a single field nests deeper than DEFAULT_FORM_DATA_MAX_DEPTH the conversion aborts with ERR_FORM_DATA_DEPTH_EXCEEDED. The cap prevents pathological or malicious field names from building enormous nested objects (resource-exhaustion / abuse guard).","triggerScenarios":"Posting or receiving FormData whose keys use bracket/dot path notation nested past the max depth — e.g. a field named `a[b][c][d][e][f]…` beyond the limit — anywhere axios runs formDataToJSON: serializing FormData request data to JSON, or transforming a multipart body into an object.","commonSituations":"Deeply nested form builders (dynamic nested arrays of objects serialized with bracket notation), frameworks like PHP/Rails-style `field[0][children][0][meta][tags][]` structures, or untrusted client input crafting deep keys. Legitimate very-deep data structures occasionally hit the default cap.","solutions":["Flatten the data model — deeply bracket-nested field names are usually a sign the payload should be sent as JSON (`Content-Type: application/json`) instead of multipart.","Send the nested part as a JSON string field (`form.append('payload', JSON.stringify(obj))`) and parse it server-side.","Restructure field names to stay within the max depth.","If the deep keys come from untrusted input, treat this error as the guard working — reject the request rather than raising the limit."],"exampleFix":"// before\nconst form = new FormData();\nform.append('a[b][c][d][e][f][g]', value); // exceeds max depth\naxios.post('/api', form);\n// after\naxios.post('/api', { a: { b: { c: { d: { e: { f: { g: value } } } } } } }); // send as JSON","handlingStrategy":"validation","validationCode":"function maxFieldDepth(formData) {\n  let max = 0;\n  for (const [name] of formData.entries()) {\n    const depth = (name.match(/\\[/g) || []).length + 1;\n    if (depth > max) max = depth;\n  }\n  return max;\n}\nif (maxFieldDepth(formData) > 5) {\n  throw new Error('form field nesting exceeds axios max depth of 5');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await axios.post(url, formData);\n} catch (err) {\n  if (err.code === 'ERR_FORM_DATA_DEPTH_EXCEEDED') {\n    // flatten the payload or send JSON instead\n  } else throw err;\n}","preventionTips":["Keep form field names like a[b][c] within 5 nesting levels — deeper structures should be sent as JSON","When parsing responses with formSerializer/formDataToJSON, validate untrusted field names first","Prefer flat field names with an explicit serialization scheme over deeply nested bracket notation"],"tags":["form-data","serialization","limits","security"],"analyzedSha":"c3f553c740ebf3dff5e22dae24e9caaafafddd2d","analyzedAt":"2026-07-31T18:49:43.633Z","schemaVersion":2}