chore(deps): update dependency form-data to v4 [security] - autoclosed #1259
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
e9775dc to
8518b7d
Compare
renovate
bot
force-pushed
the
renovate/npm-form-data-vulnerability
branch
from
8518b7d to
837ece9
Compare
renovate
bot
changed the title
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.5.1->4.0.4Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-7783
Summary
form-data uses
Math.random()to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:Because the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.
This is largely the same vulnerability as was recently found in
undicibyparrot409-- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.Details
The culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347
An attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a
x-request-idheader added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend.Math.random()is a fine place to get these sorts of IDs (in fact, opentelemetry uses Math.random for this purpose)PoC
PoC here: https://github.com/benweissmann/CVE-2025-7783-poc
Instructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID).
Impact
For an application to be vulnerable, it must:
form-datato send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)If an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.
Release Notes
form-data/form-data (form-data)
v4.0.4Compare Source
Commits
auto-changelog811f6821d11a76cryptorandom for boundary values3d172305e34080316c82b@ljharb/eslint-config58c25d72300ca1v4.0.3Compare Source
Fixed
append: avoid a crash on nullish values#577Commits
426ba9a2094191hasown81ab41bsetBoundary()method8d8e469getBoundarywith non-strings837b8a1870e4e6e6e83cceslint4066fd6c4bbb13v4.0.2Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v4.0.1Compare Source
Fixes
Tests
v4.0.0Compare Source
Merged
#382Commits
e705c0a6dd8624v3.0.4Compare Source
v3.0.3Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v3.0.2Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v3.0.1Compare Source
Merged
#451Commits
55d90cev3.0.0Compare Source
Merged
#449#448#447#442#446#434#424Fixed
#422#422Commits
80c8f74f4ca7f84bde68e2b4e478v2.5.5Compare Source
v2.5.4Compare Source
v2.5.3Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1v2.5.2Compare Source
Merged
Symbol.toStringTagwhen available#573Symbol.toStringTagwhen available#573#532#532Fixed
Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available (#573)#396Symbol.toStringTagwhen available#396Commits
92613b9806eda78fdb3bcObject.prototype.hasOwnProperty.call7fecefeObject.prototype.hasOwnProperty.call6e682d4Object.prototype.hasOwnProperty.calldf3c1e6@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescript8261fcb@types/node,browserify,coveralls,cross-spawn,eslint,formidable,in-publish,pkgfiles,pre-commit,puppeteer,request,tape,typescriptfb66cb7@types/node,browserify,coveralls,eslint,formidable,in-publish,phantomjs-prebuilt,pkgfiles,pre-commit,request,tape,typescript819f6b73217b3d3a9d480Buffer.fromandBuffer.allocrequire node 4+c499f76b82f590b170ee2combined-stream,mime-types6b1ca1drequestwhich viatough-cookie^2.4 depends onpsle5df7f2mime-types5a5bafe9457283requestwhich viatough-cookie^2.4 depends onpsl9dbe192d53265d7020dd4cross-spawn3fc1a9bedb555a10418d1Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.