Technical impact
The vulnerability stems from a lack of sanitization on the blob.type field in Axios v1.0.0 through v1.15.0. The FormDataPart constructor inserts this field directly into the Content‑Type header of each multipart body part, allowing an attacker who controls the type property to inject CRLF sequences. The injection of arbitrary MIME headers into the multipart/form‑data body can alter the behavior of servers or clients that parse the payload, potentially leading to information disclosure or request manipulation. This flaw is a classic example of CWE‑93: Improper Neutralization of Special Elements used in an Argument.
Affected Systems
Axios 1.0.0 up to, but not including, 1.15.1 is affected on both browser and Node.js environments. Applications that accept user‑uploaded Blob or File‑like objects and forward them via Axios as multipart/form‑data are potentially vulnerable. The vulnerability is present in versions 1.0.0 through 1.15.0. Updating to 1.15.1 or later removes the flaw.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the observed market. The flaw is not yet listed in CISA's KEV catalog. Exploitation requires an application boundary where an attacker can supply a Blob with a crafted type string, such as through a file‑upload endpoint. Because the injection occurs within the multipart body rather than HTTP headers, it can bypass Node.js v18+ built‑in header sanitization, giving the attacker a method to insert rogue MIME headers that could affect downstream processing. The impact is confined to applications that process the multipart payload without additional validation.
Github GHSA