fix(deps): update dependency form-data to v4 [security] #11456
+1
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
7ac9da2 to
1d5ffac
Compare
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
1d5ffac to
1019294
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
1019294 to
68b779d
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
2 times, most recently
from
ac0e2a2 to
aac4f56
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
3 times, most recently
from
4b43047 to
a81eb80
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
a81eb80 to
8a3b668
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
5 times, most recently
from
679f6dd to
dcb0805
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
dcb0805 to
32c8bac
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
^3.0.0->^4.0.0GitHub Vulnerability Alerts
CVE-2025-7783
Summary
form-data uses
Math.random()to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:Because the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.
This is largely the same vulnerability as was recently found in
undicibyparrot409-- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.Details
The culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347
An attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a
x-request-idheader added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend.Math.random()is a fine place to get these sorts of IDs (in fact, opentelemetry uses Math.random for this purpose)PoC
PoC here: https://github.com/benweissmann/CVE-2025-7783-poc
Instructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID).
Impact
For an application to be vulnerable, it must:
form-datato send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)If an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.
form-data uses unsafe random function in form-data for choosing boundary
CVE-2025-7783 / GHSA-fjxv-7rqg-78g4
More information
Details
Summary
form-data uses
Math.random()to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:Because the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.
This is largely the same vulnerability as was recently found in
undicibyparrot409-- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.Details
The culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347
An attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a
x-request-idheader added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend.Math.random()is a fine place to get these sorts of IDs (in fact, opentelemetry uses Math.random for this purpose)PoC
PoC here: https://github.com/benweissmann/CVE-2025-7783-poc
Instructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID).
Impact
For an application to be vulnerable, it must:
form-datato send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)If an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.
Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
form-data/form-data (form-data)
v4.0.4Compare Source
Commits
auto-changelog811f6821d11a76cryptorandom for boundary values3d172305e34080316c82b@ljharb/eslint-config58c25d72300ca1v4.0.3Compare Source
Fixed
append: avoid a crash on nullish values#577Commits
426ba9a2094191hasown81ab41bsetBoundary()method8d8e469getBoundarywith non-strings837b8a1870e4e6e6e83cceslint4066fd6c4bbb13v4.0.2Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v4.0.1Compare Source
Commits
757b4e3e8f0d80335ad19440d3bev4.0.0Compare Source
Merged
#382Commits
e705c0a6dd8624v3.0.4Compare Source
v3.0.3Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v3.0.2Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.