Description
The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 1.15.1
- Patched version(s): 1.15.1
References
Could your website be exposed too?
SmartScanner can check your website for Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Handlebars.js has JavaScript Injection via AST Type Confusion - CVE-2026-33937
- Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - CVE-2026-33938
- Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
- jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
You might also like:
See something that needs correcting? Let us knowUpdated May 05, 2026