HTTP Response Splitting

🗓️ 24 Apr 2026 19:20:20Reported by Snyk Security DatabaseType

Axios vulnerability: HTTP response splitting via prototype pollution in isFormData/getHeaders allows header injection.

Reporter	Title	Published	Views	Family All 130
IBM Security Bulletins	Security Bulletin:IBM Watson Discovery Cartridge affected by vulnerabilities in axios-1.12.2.tgz	9 Jun 202615:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	26 Jun 202616:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	12 Jun 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Loop has multiple vulnerabilities	24 Jul 202609:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities reported in the axios package	27 May 202612:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035	29 May 202610:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033	11 Jun 202615:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in axios-1.12.2.tgz	1 Jun 202615:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	5 May 202616:50	–	ibm

Vulners

Node

axios axiosRange<0.31.1

axios axiosRange1.0.0–1.15.1

Source	Link
security	www.security.snyk.io/vuln/SNYK-JS-AXIOS-16298058
cwe	www.cwe.mitre.org/data/definitions/CWE-113.html

01 May 2026 06:31Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.4

CVSS 49.1

EPSS0.00403

SSVC