EUVD-2026-25603
GHSA-445q-vr5w-6q77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconControl Blob.type property
-
DeliveryInject CRLF sequences
-
ExploitFormData constructor interpolates unsanitized type
-
InstallAxios constructs malformed multipart body
-
C2Transmit HTTP request with injected headers
-
ExecuteReceiving server processes injected headers
-
ImpactIntegrity or authentication compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Exploitation Conditions | The attacker must control the .type property of a Blob or File-like object passed to Axios FormData constructors in a Node.js environment. This is feasible in web applications accepting user-uploaded files, proxy services forwarding client requests, or APIs that allow clients to specify MIME types. Exploitation requires the application to transmit the FormData via Axios to an HTTP endpoint; local or disconnected scripts cannot exploit this. The vulnerability does NOT affect browser environments where Blob.type is read-only and enforced by the browser security model. Exploitation is limited to Axios versions 1.0.0-1.15.0; patched versions reject or sanitize CRLF sequences. The receiving HTTP server must be vulnerable to header injection attacks for full impact; some servers ignore injected headers, reducing practical risk. |
| Impact | The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible, unauthenticated exploitation with low complexity and integrity impact. No EPSS score, CISA KEV status, or public POC availability data provided; therefore, real-world exploitation probability cannot be independently assessed. The vulnerability is realistic but requires specific conditions: the application must process user-controlled Blob/File objects in FormData and transmit them via Axios to an HTTP endpoint. The integrity impact is moderate rather than severe-attackers can inject headers but cannot execute code or access confidential data directly. In proxy or file-processing services, header injection could enable authentication bypass, cache poisoning, or HTTP response splitting on the receiving server if it processes the injected headers. The attack complexity is low due to straightforward Blob.type manipulation, making this a real priority for services handling untrusted file uploads, but not a critical emergency for internal-only deployments. |
| Exploit ScenarioDerived | An attacker uploads a malicious file to a Node.js proxy service that uses Axios to forward the file to a backend API. The attacker crafts a File object with .type set to 'application/json\r\nContent-Disposition: form-data; name="admin"; filename="admin.txt"' and injects a crafted header that causes the receiving server to misinterpret the request structure or bypass header-based access controls. If the backend service uses headers to determine request authenticity or routing, the injected headers could violate authentication assumptions or trigger unintended logic on the receiving end. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 24, 2026
Axios HTTP client versions 1.0.0 through 1.15.0 allow header injection in multipart form-data bodies through unsanitized CRLF sequences in the Content-Type header of individual parts. An attacker controlling a Blob/File object's .type property (such as via user-uploaded files in a Node.js proxy service) can inject arbitrary MIME headers into the multipart body, bypassing Node.js v18+ built-in header protections. The vulnerability affects network-accessible services and results in integrity compromise through header manipulation.
RemediationAI
Upgrade Axios to version 1.15.1 or later immediately. Organizations unable to upgrade immediately should implement input validation on any user-supplied .type properties before passing objects to FormData constructors-explicitly sanitize or reject .type values containing CRLF sequences (\r or \n characters). If Axios must remain at older versions, disable or restrict user-controlled file uploads to services that process multipart form-data, or implement a Content-Type whitelist enforced at the application level. For Node.js proxy services, validate the entire multipart body before transmission using a library that normalizes CRLF in Content-Type headers. The patch in 1.15.1 adds CRLF sanitization to the FormDataPart constructor; no workarounds fully replicate this fix without code changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the FormDataPart constructor within lib/helpers/formDataToStream.js, where the .type property of Blob/File-like objects is directly interpolated into the Content-Type header of multipart form-data parts without CRLF normalization or validation. This is a CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers) issue. The multipart form-data protocol allows multiple headers per part, and unvalidated CRLF sequences permit injection of new header lines such as 'Content-Disposition' or custom headers. Unlike HTTP request headers, which Node.js v18+ protects through built-in validation, the multipart body is constructed as a string and transmitted as the request payload, circumventing those protections. Attackers exploiting this must have control over the .type property of objects passed to FormData, a realistic scenario in proxy services or applications processing user-supplied files.
Know when Axios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.
Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Exploit-DB