CVE-2025-54371 – axios

Package

Manager: npm
Name: axios
Vulnerable Version: <0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v4.0: N/A

EPSS: N/A pctlN/A

Details

Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data ### Withdrawn Advisory This advisory has been withdrawn because users of Axios 1.10.0 have the flexibility to use a patched version of form-data, the software in which the vulnerability originates, without upgrading Axios to address GHSA-fjxv-7rqg-78g4. ### Original Description A critical vulnerability exists in the form-data package used by `axios@1.10.0`. The issue allows an attacker to predict multipart boundary values generated using `Math.random()`, opening the door to HTTP parameter pollution or injection attacks. This was submitted in [issue #6969](https://github.com/axios/axios/issues/6969) and addressed in [pull request #6970](https://github.com/axios/axios/pull/6970). ### Details The vulnerable package `form-data@4.0.0` is used by `axios@1.10.0` as a transitive dependency. It uses non-secure, deterministic randomness (`Math.random()`) to generate multipart boundary strings. This flaw is tracked under [Snyk Advisory SNYK-JS-FORMDATA-10841150](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150) and [CVE-2025-7783](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150). Affected `form-data` versions: - <2.5.4 - >=3.0.0 <3.0.4 - >=4.0.0 <4.0.4 Since `axios@1.10.0` pulls in `form-data@4.0.0`, it is exposed to this issue. ### PoC 1. Install Axios: - `npm install axios@1.10.0` 2.Run `snyk test`: ``` Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path. ✗ Predictable Value Range from Previous Values [Critical Severity] in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0 ``` 3. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment. ### Impact - **Vulnerability Type**: Predictable Value / HTTP Parameter Pollution - **Risk**: Critical (CVSS 9.4) - **Impacted Users**: Any application using axios@1.10.0 to submit multipart form-data This could potentially allow attackers to: - Interfere with multipart request parsing - Inject unintended parameters - Exploit backend deserialization logic depending on content boundaries ### Related Links [GitHub Issue #6969](https://github.com/axios/axios/issues/6969) [Pull Request #xxxx](https://github.com/axios/axios/pull/xxxx) (replace with actual link) [Snyk Advisory](https://security.snyk.io/vuln/SNYK-JS-FORMDATA-10841150) [form-data on npm](https://www.npmjs.com/package/form-data)

Metadata

Created: 2025-07-23T16:49:38Z
Modified: 2025-07-24T13:35:30Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rm8p-cx58-hcvx/GHSA-rm8p-cx58-hcvx.json
CWE IDs: []
Alternative ID: GHSA-rm8p-cx58-hcvx
Finding: N/A
Auto approve: 0