feat(deps): update dependencies axios from v1.10.0 to v1.11.0 [security] - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	1.10.0 -> 1.11.0

GitHub Vulnerability Alerts

GHSA-rm8p-cx58-hcvx

Summary

A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.

This was submitted in issue #​6969 and addressed in pull request #​6970.

Details

The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.

This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.

Affected form-data versions:

• <2.5.4

• =3.0.0 <3.0.4

• =4.0.0 <4.0.4

Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.

PoC

1. Install Axios: - npm install axios@1.10.0
   2.Run snyk test:

Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.

✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0

3. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.

Impact

• Vulnerability Type: Predictable Value / HTTP Parameter Pollution
• Risk: Critical (CVSS 9.4)
• Impacted Users: Any application using axios@1.10.0 to submit multipart form-data

This could potentially allow attackers to:

• Interfere with multipart request parsing
• Inject unintended parameters
• Exploit backend deserialization logic depending on content boundaries

Related Links

GitHub Issue #​6969

Pull Request #xxxx (replace with actual link)

Snyk Advisory

form-data on npm

---

Release Notes

axios/axios (axios)

v1.11.0

Compare Source

Bug Fixes

• form-data npm pakcage (#​6970) (e72c193)
• prevent RangeError when using large Buffers (#​6961) (a2214ca)
• types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#​6956) (8517aa1)

Contributors to this release

• izzy goldman
• Manish Sahani
• Noritaka Kobayashi
• James Nail
• Tejaswi1305

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.