Skip to content
Log inStart free trial

GHSA-rm8p-cx58-hcvx CVE-2025-54371

Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data

High Withdrawn Jul 24, 2025 npm
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
1.11.0
Upgrade axios to this version or later

Description

Withdrawn Advisory

This advisory has been withdrawn because users of Axios 1.10.0 have the flexibility to use a patched version of form-data, the software in which the vulnerability originates, without upgrading Axios to address GHSA-fjxv-7rqg-78g4.

Original Description

A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.

This was submitted in issue #6969 and addressed in pull request #6970.

Details

The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.

This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.

Affected form-data versions:

  • <2.5.4

  • =3.0.0 <3.0.4

  • =4.0.0 <4.0.4

Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.

PoC

  1. Install Axios: - npm install axios@1.10.0 2.Run snyk test:
Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.

✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0
  1. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.

Impact

  • Vulnerability Type: Predictable Value / HTTP Parameter Pollution
  • Risk: Critical (CVSS 9.4)
  • Impacted Users: Any application using axios@1.10.0 to submit multipart form-data

This could potentially allow attackers to:

  • Interfere with multipart request parsing
  • Inject unintended parameters
  • Exploit backend deserialization logic depending on content boundaries

Related Links

GitHub Issue #6969

Pull Request #xxxx (replace with actual link)

Snyk Advisory

form-data on npm

Affected versions

npm

PackageVulnerableFixed in
axios
>= 1.10.0, < 1.11.0
1.11.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

axios npm → 1.11.0

npm
npm install axios@1.11.0
yarn
yarn add axios@1.11.0
pnpm
pnpm add axios@1.11.0

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Withdrawn
  3. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-44g4-m2mj-wpvx
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Medium Also affects axios
GHSA-x97p-jq2g-jp4f
Axios: Prototype Pollution Gadget in axios toFormData Options
High Also affects axios
GHSA-vh66-26gq-q6x8
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Medium Also affects axios
GHSA-r4gj-5m52-g5wh
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
High Also affects axios
GHSA-mghh-pgcx-3jjj
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
High Also affects axios
GHSA-m8m8-qj5v-23w3
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
High Also affects axios
GHSA-j8rh-479h-cp32
Axios: Header Injection via Inherited headers After Minimal Interceptor
Medium Also affects axios
GHSA-c29m-xwm3-cm6r
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
High Also affects axios
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor