CVE-2026-42037: axios CRLF Injection

Vulnerability summary

CVE-2026-42037 is a medium (CVSS 5.3) CRLF Injection vulnerability in axios. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-04-2026
   PublishedVulnerability first disclosed.
2. 27-04-2026
   Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.