CVE-2026-42037 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Attackers can inject arbitrary MIME headers into multipart requests via unsanitized blob types, bypassing Node.js protections and altering request structure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42037?
CVE-2026-42037 is a medium-severity vulnerability in axios, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.
Weakness: CWE-93
Which versions are affected by CVE-2026-42037?
2 open source packages ship an affected version, including axios. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | From 1.0.0 | 1.15.1 |
axios npm | From 1.0.0 | 1.15.1 |
Products include Axios Axios.
How do I fix CVE-2026-42037?
Upgrade axios to 1.15.1 or later.
Is CVE-2026-42037 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42037 exists.
Other vulnerabilities in axios
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Sources
Also known as CLEANSTART-2026-GJ80180, CLEANSTART-2026-HP63393, DEBIAN-CVE-2026-42037, ECHO-96d5-9fbe-5e29, GHSA-445q-vr5w-6q77, MINI-3fmx-xvwg-j8gp and 20 more.