CVE-2026-42037
Fixed in a distro release EPSS <1%CVSS 5.3
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js v18+ built-in header protections because the injection targets the multipart body structure, not HTTP request headers. This vulnerability is fixed in 1.15.1.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.15.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | awx | 24.6.1-r42 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r32 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.6-r3 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.3-r7 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.4-r4 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r4 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.7-r1 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r2 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.6-r2 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.4-r3 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r22 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r21 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r21 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r21 |
| Chainguard | kibana-8.19 | 8.19.15-r0 |
| Chainguard | kibana-8.19-bitnami | 8.19.15-r0 |
| Chainguard | kibana-8.19-iamguarded | 8.19.15-r0 |
| Chainguard | kibana-9.0 | 9.0.8-r24 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r24 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r24 |
| Chainguard | kibana-9.1 | 9.1.10-r16 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r16 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r0 |
| Chainguard | kibana-9.3 | 9.3.4-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.4-r4 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r21 |
| Chainguard | langfuse-2 | 2.95.12-r23 |
| Chainguard | langfuse-2-worker | 2.95.12-r23 |
| Chainguard | langfuse-3 | 3.174.1-r0 |
| Chainguard | langfuse-3-worker | 3.174.1-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r25 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r25 |
| Chainguard | langfuse-fips-3 | 3.174.1-r0 |
| Chainguard | langfuse-fips-3-worker | 3.174.1-r0 |
| Chainguard | lerna | 9.0.7-r4 |
| Chainguard | nextcloud-server-31 | 31.0.14-r5 |
| Chainguard | nextcloud-server-33 | 33.0.6-r0 |
| Chainguard | nextcloud-server-34 | 34.0.1-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r10 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r10 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r9 |
| Chainguard | opensearch-dashboards-3 | 3.6.0-r3 |
| Chainguard | opensearch-dashboards-3-fips | 3.6.0-r5 |
| Chainguard | prism | 5.15.10-r0 |
| Chainguard | redisinsight | 3.4.2-r1 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | wazuh-dashboard | 4.14.5-r5 |
| Chainguard | wazuh-dashboard-fips | 4.14.5-r5 |
| Chainguard | wazuh-dashboard-plugins | 4.14.4-r3 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.15.2-1 |
| Ubuntu 25.10 | node-axios | no fix |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r22 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r21 |
| Wolfi | langfuse-3 | 3.174.1-r0 |
| Wolfi | langfuse-3-worker | 3.174.1-r0 |
| Wolfi | lerna | 9.0.7-r4 |
| Wolfi | nextcloud-server-33 | 33.0.6-r0 |
| Wolfi | opensearch-dashboards-3 | 3.6.0-r3 |
| Wolfi | prism | 5.15.10-r0 |
| Wolfi | saf | 1.6.0-r0 |