Threats tagged 'ghsa-445q-vr5w-6q77'

Axios versions from 1.0.0 up to but not including 1.15.1 contain a CRLF injection vulnerability in the multipart/form-data body construction. The vulnerability arises because the value.type property of Blob/File-like objects is interpolated directly into the Content-Type header of each multipart part without sanitizing carriage return and line feed characters. This allows an attacker controlling the MIME type of an uploaded file to inject arbitrary headers into the multipart body, potentially bypassing server-side filters and confusing multipart parsers. The issue is fixed in version 1.15.1.