There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the
    FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the
    Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who
    controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy
    service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js
    v18+ built-in header protections because the injection targets the multipart body structure, not HTTP
    request headers. This vulnerability is fixed in 1.15.1. (CVE-2026-42037)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Axios 是一个基于承诺的 HTTP 客户端，适用于浏览器和Node.js。从 1.0.0 到 之前 1.15.1，lib/helpers/formDataToStream.js 中的 FormDataPart 构造函数直接插值 value.type 到每个多部分部分的 Content-Type 头部，而不净化 CRLF （\r\n） 序列。控制 Blob/File类对象 .type 属性的攻击者（例如通过 Node.js 代理服务中用户上传的文件）可以向多部分表单数据体注入任意 MIME 部分头。这绕过了Node.js v18+内置的头部保护，因为注入针对的是多部分体结构，而非HTTP请求头。此漏洞已在 1.15.1 中修复。(CVE-2026-42037)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端主機上安裝的 Node.js 模組為 1.15.1 之前的版本，因此，該應用程式受到以下弱點影響：

  - 透過 formDataToStream 中未清理的 blob.type 在 multipart/form-data 內文中插入 CRLF。（CVE-2026-42037）

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 axios Node.js 模块的版本低于 1.15.1。因此，该产品系列受到以下漏洞的影响：

  - 通过 formDataToStream 中未审查的 blob.type 在多部分/表单数据正文中注入 CRLF。（CVE-2026-42037）

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Axios 是一個基於承諾的 HTTP 用戶端，適用於瀏覽器與Node.js。從 1.0.0 到 之前 1.15.1，FormDataPart 建構子在 lib/helpers/formDataToStream.js 中直接插值 value.type 到每個多部分的 Content-Type 標頭，且不淨化 CRLF （\r\n） 序列。控制 Blob/File（類似 Blob/File）物件的 .type 屬性的攻擊者（例如透過 Node.js 代理服務中使用者上傳的檔案）可以將任意的 MIME 部分標頭注入多部分表單資料體中。這繞過了 v18+ 內建的標頭保護Node.js因為注入目標是多部分主體結構，而非 HTTP 請求標頭。此弱點已在 1.15.1 中修正。(CVE-2026-42037)

請注意，Nessus 依賴供應商報告的套件存在。

リモートホストにインストールされている axios Node.js モジュールのバージョンは、1.15.1 より前です。したがって、以下の脆弱性の影響を受けます。

  - formDataToStream のサニタイズされていない blob.type による、multipart/form-data 本文における CRLF インジェクション。(CVE-2026-42037)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - AxiosはブラウザおよびNode.js向けの約束ベースのHTTPクライアントです。1.0.0から1.15.1以前まで、lib/helpers/formDataToStream.jsのFormDataPartコンストラクタは、CRLF(\r\n)シーケンスをサニタイトせずに、各マルチパートのContent-Typeヘッダーに直接補間します。Blobやファイルに似たオブジェクトの.typeプロパティを制御する攻撃者は(例:Node.jsプロキシサービス内のユーザーアップロードファイルを通じて)、任意のMIMEパートヘッダーをマルチパートフォームデータボディに注入できます。これにより、注入はHTTPリクエストヘッダーではなくマルチパートボディ構造を対象とするため、v18+の組み込みヘッダー保護をNode.js回避できます。この脆弱性は 1.15.1 で修正されました。(CVE-2026-42037)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The version of the axios Node.js module installed on the remote host is prior to 1.15.1. It is, therefore, affected by the following vulnerability:

  - CRLF injection in multipart/form-data body via unsanitized blob.type in formDataToStream. (CVE-2026-42037)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42037:
    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1.

    CVE-2026-42035:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the     application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1     and 0.31.1.

    CVE-2026-42033:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1.

    CVE-2026-41242:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and     7.5.5, attackers can inject arbitrary code in the type fields of protobuf definitions, which will then     execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    CVE-2026-33896:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints     requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions.
    This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates,     which node-forge will accept as valid. Version 1.4.0 patches the issue.

    CVE-2026-33895:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the     scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both     verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by     the specification. This class of signature malleability has been exploited in practice to bypass     authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on     signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization     checks) may be bypassed. Version 1.4.0 patches the issue.

    CVE-2026-33894:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public     exponent keys (e=3). Attackers can forge signatures by stuffing garbage bytes within the ASN     structure in order to construct a signature that passes verification, enabling Bleichenbacher style     forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN     structure, rather than outside of it.  Additionally, forge does not validate that signatures include a     minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to     construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

    CVE-2026-33891:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an     infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When     modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an     unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0     patches the issue.

    CVE-2026-33228:
    flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2.

    CVE-2026-32141:
    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive()     phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested     or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the     Node.js process. This vulnerability is fixed in 3.4.0.

    CVE-2026-29074:
    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
    From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version     4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This     can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process     with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1. (CVE-2026-42037)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
441066	SCA: security update for axios (GHSA-445q-vr5w-6q77)	Tenable Self-Hosted Container Security	SCA Checks	2026/5/5	2026/7/2	medium
441066	SCA: security update for axios (GHSA-445q-vr5w-6q77)	Tenable Cloud Security	SCA Checks	2026/5/5	2026/7/2	medium
310469	Linux Distros 未修补的漏洞：CVE-2026-42037	Nessus	Misc.	2026/4/27	2026/6/20	medium
313223	Node.js 模組 axios < 1.15.1 CRLF 注入（CVE-2026-42037）	Nessus	Misc.	2026/5/8	2026/5/11	medium
313223	Node.js 模块 axios < 1.15.1 CRLF 注入（CVE-2026-42037）	Nessus	Misc.	2026/5/8	2026/5/11	medium
310469	Linux Distros 未修補的弱點：CVE-2026-42037	Nessus	Misc.	2026/4/27	2026/6/20	medium
313223	Node.js モジュール axios < 1.15.1 CRLF インジェクション (CVE-2026-42037)	Nessus	Misc.	2026/5/8	2026/5/11	medium
310469	Linux Distros のパッチ未適用の脆弱性: CVE-2026-42037	Nessus	Misc.	2026/4/27	2026/6/20	medium
313223	Node.js Module axios < 1.15.1 CRLF Injection (CVE-2026-42037)	Nessus	Misc.	2026/5/8	2026/5/11	medium
319720	TencentOS Server 4: grafana (TSSA-2026:0295)	Nessus	Tencent Local Security Checks	2026/6/8	2026/6/8	critical
310469	Linux Distros Unpatched Vulnerability : CVE-2026-42037	Nessus	Misc.	2026/4/27	2026/6/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium