This advisory has been withdrawn because users of Axios 1.10.0 have the flexibility to use a patched version of form-data, the software in which the vulnerability originates, without upgrading Axios to address GHSA-fjxv-7rqg-78g4.
Original Description
A critical vulnerability exists in the form-data package used by [email protected]. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.
The vulnerable package [email protected] is used by [email protected] as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.
Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.
✗ Predictable Value Range from Previous Values [Critical Severity]
in [email protected] via [email protected] > [email protected]
Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.
Impact
Vulnerability Type: Predictable Value / HTTP Parameter Pollution
Risk: Critical (CVSS 9.4)
Impacted Users: Any application using [email protected] to submit multipart form-data
This could potentially allow attackers to:
Interfere with multipart request parsing
Inject unintended parameters
Exploit backend deserialization logic depending on content boundaries