EUVD-2026-25603
GHSA-445q-vr5w-6q77
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionGitHub Advisory
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.
AnalysisAI
Axios HTTP client versions 1.0.0 through 1.15.0 allow header injection in multipart form-data bodies through unsanitized CRLF sequences in the Content-Type header of individual parts. An attacker controlling a Blob/File object's .type property (such as via user-uploaded files in a Node.js proxy service) can inject arbitrary MIME headers into the multipart body, bypassing Node.js v18+ built-in header protections. The vulnerability affects network-accessible services and results in integrity compromise through header manipulation.
Technical ContextAI
The vulnerability resides in the FormDataPart constructor within lib/helpers/formDataToStream.js, where the .type property of Blob/File-like objects is directly interpolated into the Content-Type header of multipart form-data parts without CRLF normalization or validation. This is a CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers) issue. The multipart form-data protocol allows multiple headers per part, and unvalidated CRLF sequences permit injection of new header lines such as 'Content-Disposition' or custom headers. Unlike HTTP request headers, which Node.js v18+ protects through built-in validation, the multipart body is constructed as a string and transmitted as the request payload, circumventing those protections. Attackers exploiting this must have control over the .type property of objects passed to FormData, a realistic scenario in proxy services or applications processing user-supplied files.
RemediationAI
Upgrade Axios to version 1.15.1 or later immediately. Organizations unable to upgrade immediately should implement input validation on any user-supplied .type properties before passing objects to FormData constructors-explicitly sanitize or reject .type values containing CRLF sequences (\r or \n characters). If Axios must remain at older versions, disable or restrict user-controlled file uploads to services that process multipart form-data, or implement a Content-Type whitelist enforced at the application level. For Node.js proxy services, validate the entire multipart body before transmission using a library that normalizes CRLF in Content-Type headers. The patch in 1.15.1 adds CRLF sanitization to the FormDataPart constructor; no workarounds fully replicate this fix without code changes.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today