fix(deps): vuln minor: url-parse · patch: form-data, node-fetch [samples/openapi3]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• samples/openapi3 (npm)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
url-parse	1.4.3	1.5.10	minor	Direct	2 CRITICAL, 12 MODERATE
url-parse	1.4.3	1.5.10	minor	Direct	2 CRITICAL, 12 MODERATE
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MODERATE
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MODERATE
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MODERATE
url-parse	1.5.4	1.5.10	patch	Direct	2 CRITICAL, 6 MODERATE
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
form-data	2.5.1	2.5.5	patch	Direct	2 CRITICAL
node-fetch	2.6.0	2.6.13	patch	Direct	2 HIGH, 2 LOW
node-fetch	2.6.0	2.6.13	patch	Direct	2 HIGH, 2 LOW

---

Security Details

🚨 Critical & High Severity (30 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
form-data	GHSA-fjxv-7rqg-78g4	CRITICAL	form-data uses unsafe random function in form-data for choosing boundary	2.5.1	2.5.4
form-data	CVE-2025-7783	CRITICAL	-	2.5.1	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.5.4	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.5.4	1.5.8
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
node-fetch	CVE-2022-0235	HIGH	Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch	2.6.0	-
node-fetch	GHSA-r683-j2x4-v87g	HIGH	node-fetch forwards secure headers to untrusted sites	2.6.0	3.1.1
node-fetch	CVE-2022-0235	HIGH	Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch	2.6.0	-
node-fetch	GHSA-r683-j2x4-v87g	HIGH	node-fetch forwards secure headers to untrusted sites	2.6.0	3.1.1

ℹ️ Other Vulnerabilities (64)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.5.4	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.5.4	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.5.4	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.5.4	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.5.4	1.5.6
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.5.4	1.5.7
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
node-fetch	CVE-2020-15168	LOW	-	2.6.0	-
node-fetch	GHSA-w7rc-rwvf-8q5r	LOW	The size option isn't honored after following a redirect in node-fetch	2.6.0	2.6.1
node-fetch	CVE-2020-15168	LOW	-	2.6.0	-
node-fetch	GHSA-w7rc-rwvf-8q5r	LOW	The size option isn't honored after following a redirect in node-fetch	2.6.0	2.6.1

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: Vulnerability Remediation (Critical/High)

🤖 Generated by DataDog Automated Dependency Management System