Skip to content

Commit 59aca8d

Browse files
committed
1 parent 8faca16 commit 59aca8d

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

advisories/github-reviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-75v8-2h7p-7m2m",
4-
"modified": "2025-05-27T18:49:20Z",
4+
"modified": "2025-05-27T18:49:22Z",
55
"published": "2025-04-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-46653"
88
],
99
"summary": "Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content",
10-
"details": "Formidable (aka node-formidable) 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not \"cryptographically secure.\" (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.",
10+
"details": "Based on the detailed context of the Dependabot alert for **formidable@2.1.2** (introduced via **supertest@6.3.3**) and its low-risk vulnerability ([CVE-2025-46653](https://nvd.nist.gov/vuln/detail/CVE-2025-46653)), here's a refined action plan addressing dependency constraints and practical mitigation strategies:\n\n---\n\n### **Immediate Remediation Strategy**\n#### 1. **Assess Actual Risk Exposure**\n - **Vulnerability Scope**: The issue involves non-cryptographic filename generation for uploaded files. If your project:\n - Doesn't handle file uploads via `formidable`\n - Stores uploads in non-executable locations (e.g., cloud storage)\n - Uses additional sanitization for filenames\n → **Risk is negligible**. [Dismiss the alert](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/viewing-and-updating-dependabot-alerts#dismissing-dependabot-alerts) with a comment like:\n > *\"No file upload functionality used; formidable exploit path not reachable.\"*\n\n#### 2. **Workaround: Force Dependency Resolution**\n Since `supertest@6.3.3` locks `formidable` to `^2.1.2`, force an upgrade using:\n - **Yarn** (add to `package.json`):\n ```json\n \"resolutions\": {\n \"formidable\": \">=3.5.4\"\n }\n ```\n - **npm** (add to `package.json`):\n ```json\n \"overrides\": {\n \"formidable\": \">=3.5.4\"\n }\n ```\n - **pnpm** (add to `package.json`):\n ```json\n \"pnpm\": {\n \"overrides\": {\n \"formidable\": \">=3.5.4\"\n }\n }\n ```\n - Run `npm install`/`yarn install` afterward. \n ⚠️ **Test thoroughly**: Verify `supertest` compatibility with `formidable@3.5.4+`.\n\n#### 3. **Upstream Advocacy**\n - **Create an issue in supertest**: \n Request a dependency update at [supertest#issues](https://github.com/ladjs/supertest/issues). Example:\n > *\"Please upgrade formidable to ^3.5.4 to patch CVE-2025-46653. Current constraint (^2.1.2) exposes downstream users to low-severity vulnerability.\"*\n\n - **Temporary fork (last resort)**:\n 1. Fork `supertest`\n 2. Update its `formidable` dependency to `^3.5.4`\n 3. Install from your fork:\n ```bash\n npm install github:your-username/supertest#your-branch\n ```\n\n---\n\n### **Long-Term Prevention**\n#### 1. **Dependency Hardening**\n | Technique | Implementation Example |\n |----------------------------|-------------------------------------------|\n | **Lockfile pinning** | `package-lock.json` or `yarn.lock` |\n | **CI-based audits** | Add to GitHub Actions:\n ```yaml\n - name: Audit dependencies\n run: npm audit --audit-level=moderate\n ``` |\n | **SBOM generation** | Use `cyclonedx-npm` for supply-chain visibility |\n\n#### 2. **Architectural Mitigations**\n - **Isolate testing dependencies**:\n ```json\n {\n \"devDependencies\": {\n \"supertest\": \"^6.3.3\"\n }\n }\n ```\n - **Runtime protection**:\n ```javascript\n // Block formidable in production if unused\n if (process.env.NODE_ENV === 'production') {\n delete require.cache[require.resolve('formidable')];\n }\n ```\n\n#### 3. **Monitoring & Automation**\n - Enable **GitHub Advanced Security** for:\n - Dependency graph analysis\n - Secret scanning\n - CodeQL (custom query: [Detect formidable usage](https://codeql.github.com))\n - Use **RenovateBot** for:\n - Scheduled dependency updates\n - Auto-merges for patch-level changes\n\n---\n\n### **Decision Tree: Next Steps**\n```mermaid\ngraph TD\n A[Dependabot Alert #5] --> B{Does app handle file uploads?}\n B -->|Yes| C[Force-upgrade formidable via resolutions]\n B -->|No| D[Dismiss alert with justification]\n C --> E[Test supertest functionality]\n E -->|Works| F[Deploy fix]\n E -->|Fails| G[Advocate supertest update or switch to alternatives]\n G --> H[jest-http-server or undici]\n```\n\n---\n\n### **Alternative Tools**\nIf `supertest` compatibility fails:\n| Tool | Install Command | Notes |\n|---------------------|----------------------------|--------------------------------|\n| **undici** | `npm install undici` | Fetch-compatible HTTP client |\n| **jest-http-mock** | `npm install jest-http-mock`| Lightweight mock server |\n| **MSW (Mock Service Worker)** | `npm install msw` | Intercepts network requests |\n\n---\n\n### **Key Takeaways**\n1. **Low-risk ≠ no-risk**: Even CVSS 3.1 vulnerabilities warrant evaluation.\n2. **Transitive dependencies** require proactive governance (e.g., `npm ls formidable`).\n3. **Resolutions/overrides** are temporary fixes—track upstream updates.\n\nProceed with dependency resolution (Step 2), and monitor supertest for updates. If you need help implementing CI checks or dependency graphs, share your repo structure!",
1111
"severity": [
1212
{
1313
"type": "CVSS_V3",

0 commit comments

Comments
 (0)