CVE-2026-42037 - Vulnerability Analysis

Overview

Axios 1.0.0 to < 1.15.1 contains a HTTP header injection caused by unsanitized CRLF sequences in FormDataPart constructor's value.type, letting attackers inject arbitrary MIME part headers, exploit requires control of Blob/File-like object's type property.

Severity & Score

Impact

Attackers can inject arbitrary MIME headers in multipart form-data, potentially bypassing built-in header protections and manipulating request bodies.

Mitigation

Upgrade to version 1.15.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner