Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Description

The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0, < 1.15.1
• Patched version(s): 1.15.1

References

• GHSA-445q-vr5w-6q77
• CVE-2026-42037
• CWE-93
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Handlebars.js has JavaScript Injection via AST Type Confusion - CVE-2026-33937
• Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - CVE-2026-33938
• Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

axios