GHSA-RM8P-CX58-HCVX

Vulnerability from github – Published: 2025-07-23 16:49 – Updated: 2025-07-24 13:35
Withdrawn 2025-07-24 VLAI
Summary
Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data
Details

Withdrawn Advisory

This advisory has been withdrawn because users of Axios 1.10.0 have the flexibility to use a patched version of form-data, the software in which the vulnerability originates, without upgrading Axios to address GHSA-fjxv-7rqg-78g4.

Original Description

A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.

This was submitted in issue #6969 and addressed in pull request #6970.

Details

The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.

This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.

Affected form-data versions: - <2.5.4 - >=3.0.0 <3.0.4 - >=4.0.0 <4.0.4

Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.

PoC

  1. Install Axios: - npm install axios@1.10.0 2.Run snyk test:
Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.

✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0
  1. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.

Impact

  • Vulnerability Type: Predictable Value / HTTP Parameter Pollution
  • Risk: Critical (CVSS 9.4)
  • Impacted Users: Any application using axios@1.10.0 to submit multipart form-data

This could potentially allow attackers to: - Interfere with multipart request parsing - Inject unintended parameters - Exploit backend deserialization logic depending on content boundaries

Related Links

GitHub Issue #6969

Pull Request #xxxx (replace with actual link)

Snyk Advisory

form-data on npm

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54371"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-23T16:49:38Z",
    "nvd_published_at": "2025-07-23T21:15:26Z",
    "severity": "HIGH"
  },
  "details": "### Withdrawn Advisory\nThis advisory has been withdrawn because users of Axios 1.10.0 have the flexibility to use a patched version of form-data, the software in which the vulnerability originates, without upgrading Axios to address GHSA-fjxv-7rqg-78g4.\n\n### Original Description\nA critical vulnerability exists in the form-data package used by `axios@1.10.0`. The issue allows an attacker to predict multipart boundary values generated using `Math.random()`, opening the door to HTTP parameter pollution or injection attacks.\n\nThis was submitted in [issue #6969](https://github.com/axios/axios/issues/6969) and addressed in [pull request #6970](https://github.com/axios/axios/pull/6970).\n\n### Details\nThe vulnerable package `form-data@4.0.0` is used by `axios@1.10.0` as a transitive dependency. It uses non-secure, deterministic randomness (`Math.random()`) to generate multipart boundary strings.\n\nThis flaw is tracked under [Snyk Advisory SNYK-JS-FORMDATA-10841150](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150) and [CVE-2025-7783](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150).\n\nAffected `form-data` versions:\n- \u003c2.5.4\n- \u003e=3.0.0 \u003c3.0.4\n- \u003e=4.0.0 \u003c4.0.4\n\nSince `axios@1.10.0` pulls in `form-data@4.0.0`, it is exposed to this issue.\n\n\n### PoC\n1. Install Axios: - `npm install axios@1.10.0`\n2.Run `snyk test`:\n```\nTested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.\n\n\u2717 Predictable Value Range from Previous Values [Critical Severity]\nin form-data@4.0.0 via axios@1.10.0 \u003e form-data@4.0.0\n\n```\n3. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.\n\n\n### Impact\n\n- **Vulnerability Type**: Predictable Value / HTTP Parameter Pollution\n- **Risk**: Critical (CVSS 9.4)\n- **Impacted Users**: Any application using axios@1.10.0 to submit multipart form-data\n\n\nThis could potentially allow attackers to:\n- Interfere with multipart request parsing\n- Inject unintended parameters\n- Exploit backend deserialization logic depending on content boundaries\n\n### Related Links\n[GitHub Issue #6969](https://github.com/axios/axios/issues/6969)\n\n[Pull Request #xxxx](https://github.com/axios/axios/pull/xxxx) (replace with actual link)\n\n[Snyk Advisory](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150)\n\n[form-data on npm](https://www.npmjs.com/package/form-data)",
  "id": "GHSA-rm8p-cx58-hcvx",
  "modified": "2025-07-24T13:35:30Z",
  "published": "2025-07-23T16:49:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-rm8p-cx58-hcvx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54371"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7783"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/issues/6969"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/pull/6970"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data",
  "withdrawn": "2025-07-24T13:35:30Z"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.