PT-2026-35047 · Npm · Axios

Kobi-S · Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42037

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.15.0

Description The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates the value.type property directly into the Content-Type header of each multipart part without sanitizing CRLF (carriage return and line feed) sequences. An attacker controlling the .type property of a Blob or File-like object can inject arbitrary MIME part headers into the multipart form-data body. This action bypasses built-in header protections in Node.js v18 and later because the injection occurs within the multipart body structure rather than the HTTP request headers.

Recommendations Update to version 1.15.1.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42037

GHSA-445Q-VR5W-6Q77

Affected Products

Axios

References · 212

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239 · Security Note