[Vulnerability] axios/axios: CRLF Injection

[github-actions]

Potential Security Vulnerability Detected

Repository: axios/axios
Commit: 5d2af04
Author: Afonso Jorge Ramos
Date: 2026-06-22T18:28:55Z

Commit Message

chore(deps): bump form-data floor to ^4.0.6 to patch CRLF injection (#11028)

Pull Request

PR: #11028 - chore(deps): bump form-data floor to ^4.0.6 to patch CRLF injection
Labels: commit::chore

Description:

Summary

Bumps the form-data runtime dependency range floor from ^4.0.5 to ^4.0.6.

form-data versions >=4.0.0 <4.0.6 are affected by a CRLF injection via unescaped multipart field names and filenames ([GHSA-hmw2-7cc7-3qxx](GHSA-hmw2-7cc7-3qxx), high severity). The current ^4.0.5 floor still permits the vulnerable 4.0.5, so consumers see npm audit warnings until they manually override the transitive resolution.

The committed package-lock.json a...

Analysis

Vulnerability Type: CRLF Injection
Severity: High

Description

This patch updates the 'form-data' dependency to version 4.0.6, which fixes a CRLF injection vulnerability present in versions 4.0.0 through 4.0.5. The vulnerability allows an attacker to inject malicious carriage return and line feed characters via unescaped multipart form field names and filenames, potentially enabling HTTP response splitting or header injection attacks.

Affected Code

In form-data versions >=4.0.0 <4.0.6, multipart field names and filenames were not properly escaped, allowing CRLF characters to be injected.

Proof of Concept

Send a multipart/form-data POST request with a field name or filename containing a CRLF sequence, e.g.:

--boundary
Content-Disposition: form-data; name="malicious\r\nInjected-Header: injected-value"

exploit
--boundary--

This causes the HTTP headers in the downstream request to be split, allowing injection of arbitrary headers or manipulation of the response.

---

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-06-23T00:02:09.062Z