CVE-2026-42037

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

No known exploitation. EPSS puts it in the 26th percentile. Fixed in 1.15.1.

CVSS 3.15.3Medium EPSS percentile26th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1.15.1Upgrade to this build

Published 2026-04-24Updated 2026-04-27Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

AxiosAffected: ≥ 1.0.0, < 1.15.1Upgrade to: 1.15.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your applications use axios 1.0.0 through before 1.15.1 and forward files or form submissions from users.
Upgrade axios to version 1.15.1.
If upgrading is delayed, reject file type values containing line breaks before sending multipart uploads.
Test upload and proxy workflows after the update.

npm install axios@1.15.1

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.

In plain language

Written by AI from the record

axios versions 1.0.0 through before 1.15.1 can let a malicious upload alter parts of an outgoing file submission; small businesses should update if they relay user uploads.

CWE-93 CRLF injection in axios multipart serialization allows an attacker-controlled Blob/File-like `type` value to inject arbitrary MIME-part headers in `formDataToStream`.

If you're affected

Altered upload metadata
Manipulated multipart requests
Downstream processing errors

What is it

This flaw can let someone put extra instructions into the packaging around a file your system sends onward. It is like a customer slipping additional labels into a shipment box so the receiving department may handle part of the shipment differently.

Who is affected

This matters to you if you use axios in a service that accepts files or form data from people and sends those uploads to another system. It is only a risk when an attacker can control a file-like object's type value used in a multipart upload.

How urgent is it

There is no known active exploitation, and no public exploit code is on record. Treat this as an amber-priority maintenance fix: address it promptly in upload-forwarding services, especially those exposed to untrusted users.

What to do — in detail

Confirm exposure by reviewing dependency lockfiles and deployed package inventories for axios versions 1.0.0 through before 1.15.1. Then identify code paths that create multipart requests from user-controlled Blob or File-like objects, particularly upload proxy services.

Upgrade to axios 1.15.1; the findings provide this single fixed version and do not identify separate maintenance branches. Run integration tests for multipart uploads and downstream receivers after deployment. If patching must wait, validate or replace user-controlled MIME type values and reject \r or \n characters before axios constructs the multipart body.

No CISA KEV due date applies because this CVE is not listed in KEV. Monitor application errors and downstream upload-processing logs for unexpected multipart fields or content-type behavior during and after remediation.

Technical context

CVSS 5.3 (Medium): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue is CWE-93 CRLF injection: formDataToStream interpolates an attacker-controlled Blob/File-like type into a multipart part's Content-Type header, allowing injected MIME-part headers within the request body. This affects axios 1.0.0 through before 1.15.1 and is fixed in 1.15.1. It is not listed in CISA KEV, no public exploit code is recorded, and EPSS is 0.3% with a flat trend; exploit maturity is therefore unproven.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS26th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 26th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 146 days, from the signal feeds we watch.

2026-09-17OpenVAS check added
2026-04-27Workaround availablerecord updated
2026-04-24Publishedweakness classified

Affected products

axiospackage-ecosystem
- axiosLibraryOSS Libraries / npm

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation