CRLF Injection

🗓️ 24 Apr 2026 19:19:52Reported by Snyk Security DatabaseType

CRLF injection in axios FormDataPart header allows header corruption via a Blob with CR or LF; upgrade to 1.15.1 or higher.

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin:IBM Watson Discovery Cartridge affected by vulnerabilities in axios-1.12.2.tgz	9 Jun 202615:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	26 Jun 202616:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	12 Jun 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Loop has multiple vulnerabilities	24 Jul 202609:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities reported in the axios package	27 May 202612:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035	29 May 202610:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033	11 Jun 202615:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in axios-1.12.2.tgz	1 Jun 202615:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	5 May 202616:50	–	ibm

Vulners

Node

axios axiosRange1.3.0–1.15.1

Source	Link
security	www.security.snyk.io/vuln/SNYK-JS-AXIOS-16299819
cwe	www.cwe.mitre.org/data/definitions/CWE-93.html

29 Apr 2026 05:26Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.3 - 5.8

CVSS 46.9

EPSS0.00294

SSVC