CVE-2026-42037: CRLF Injection in Axios Multipart Form Data Generation Vulnerability ID: CVE-2026-42037 CVSS Score: 5.3 Published: 2026-05-05 A CRLF injection vulnerability exists in Axios versions 1.0.0 through 1.15.0 when operating in a Node.js environment. The flaw allows attackers to inject arbitrary headers into multipart/form-data payloads due to improper sanitization of the file type property, bypassing native Node.js HTTP header protections. TL;DR Axios < 1.15.1 is vulnerable to CRLF injection within multipart/form-data bodies. Attackers controlling the MIME type of uploaded files can inject malicious headers or manipulate the body payload. Upgrading to 1.15.1 resolves the issue.…