CVE-2026-42037: CRLF Injection in Axios Multipart Form Data Generation

Vulnerability ID: CVE-2026-42037

CVSS Score: 5.3

Published: 2026-05-05

A CRLF injection vulnerability exists in Axios versions 1.0.0 through 1.15.0 when operating in a Node.js environment. The flaw allows attackers to inject arbitrary headers into multipart/form-data payloads due to improper sanitization of the file type property, bypassing native Node.js HTTP header protections.

TL;DR

Axios < 1.15.1 is vulnerable to CRLF injection within multipart/form-data bodies. Attackers controlling the MIME type of uploaded files can inject malicious headers or manipulate the body payload.…