GHSA-hmw2-7cc7-3qxx found in npm/form-data@4.0.5

## GHSA-hmw2-7cc7-3qxx found in npm/form-data@4.0.5 
> [!important] 
> **Risk**: `1.72 (Low)`
> **CVSS**: `7.5` 
### Description
## Summary

`form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\r`), LF (`\n`), or `"`. An application that uses **untrusted input as a field name or filename** therefore lets an attacker terminate the header line and either inject additional headers or smuggle whole additional multipart parts into the request the application forwards to a backend.

This is CWE-93 (CRLF injection). It is a divergence from how browsers and the WHATWG HTML spec serialize form-data (they escape these characters), so the fix is to match that behavior. Severity is **conditional**: it depends on the consuming application passing attacker-controlled data as a field name or filename. Applications that only use fixed/trusted field names are not affected.

## Details

In `lib/form_data.js`, `_multiPartHeader` builds the part header as:

```javascript
'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || [])
```

and `_getContentDisposition` builds `filename="' + filename + '"'`. Neither escapes control characters, so a `\r\n` in `field`/`filename` ends the header line. The same applies to `"`, which can break out of the quoted parameter.

### Proof of concept

```javascript
const FormData = require('form-data');
const form = new FormData();
form.append('email"\r\nX-Injected: true\r\nfake="', 'user@example.com');
console.log(form.getBuffer().toString());
```

Before the fix this emits an injected `X-Injected: true` header line. A field name that also includes `--<boundary>` sequences can introduce additional parts (e.g. an extra `name="is_admin"` field), which a downstream parser accepts as legitimate.

## Impact

For an application that uses untrusted field names/filenames:

- **Field injection / override (integrity).** Inject or override fields the backend trusts (e.g. `is_admin`, `role`) — the primary demonstrated impact.
- **Header injection** into the generated multipart part.

Claims of guaranteed privilege escalation, authentication bypass, high confidentiality impact, and availability impact are application-dependent downstream consequences, not properties of `form-data` itself, and are not demonstrated by the PoC.

### Severity

The demonstrated, library-attributable impact is integrity (field/header injection); there is no demonstrated confidentiality disclosure or availability impact in `form-data` itself, and exploitation requires the consuming app to feed untrusted data into field names/filenames. A Moderate (≈5.3, `I:L`) rating is also defensible given that precondition.

## Patch

Fixed in **4.0.6**, **3.0.5**, and **2.5.6**. Users on older 0.x/1.x/2.x releases should upgrade to 2.5.6 or later.

The fix escapes `\r`, `\n`, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the WHATWG HTML `multipart/form-data` encoding algorithm that browsers implement. This neutralizes the injection while leaving ordinary field names (including `name[0]`, dotted, and unicode names) unchanged.

## Workaround

Until upgrading, validate or reject field names/filenames that contain control characters before calling `append`:

```javascript
if (/[\r\n]/.test(field)) { throw new Error('invalid field name'); }
```

## Credit

Reported by [yueyueL](https://github.com/yueyueL).
### Affected component 
The vulnerability is in `pkg:npm/form-data@4.0.5`, found in artifacts `pkg:oci/l3montree-cybersecurity/devguard/devguard-documentation`.
### Recommended fix
Upgrade to version 4.0.6 or later.
```
# Update all vulnerable npm packages
npm audit fix
# Update only this package
npm install form-data@4.0.6 
```
### Additional guidance for mitigating vulnerabilities
Visit our guides on [devguard.org](https://devguard.org/risk-mitigation-guides/software-composition-analysis)

<details>

<summary>See more details...</summary>

### Path to component
```mermaid 
 %%{init: { 'theme':'base', 'themeVariables': {
'primaryColor': '#F3F3F3',
'primaryTextColor': '#0D1117',
'primaryBorderColor': '#999999',
'lineColor': '#999999',
'secondaryColor': '#ffffff',
'tertiaryColor': '#ffffff'
} }}%%
 flowchart TD
Your_application(["Your application"]) --- pkg_npm_axios_1_16_1(["pkg:npm/axios\@1.16.1"])
pkg_npm_axios_1_16_1(["pkg:npm/axios\@1.16.1"]) --- pkg_npm_form_data_4_0_5(["pkg:npm/form-data\@4.0.5"])

classDef default stroke-width:2px
```
| Risk Factor | Value | Description | 
| ---- | ----- | ----------- | 
| Vulnerability Depth | `2` | The vulnerability is in a dependency of a dependency in your project. It is 2 levels deep. | 
| EPSS | `0.00 %` | The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days. | 
| EXPLOIT | `Not available` | We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability. | 
| CVSS-BE | `7.5` | - Exploiting this vulnerability significantly impacts integrity. | 
| CVSS-B | `7.5` | - The vulnerability can be exploited over the network without needing physical access. - It is easy for an attacker to exploit this vulnerability. - An attacker does not need any special privileges or access rights. - No user interaction is needed for the attacker to exploit this vulnerability. - The impact is confined to the system where the vulnerability exists. - There is a high impact on the integrity of the data. | 

More details can be found in [DevGuard](https://main.devguard.org/l3montree-cybersecurity/projects/devguard/assets/devguard-documentation/refs/main/dependency-risks/440ac861-8f05-6769-3583-41a25bad845e)

</details>


--- 
### Interact with this vulnerability
You can use the following slash commands to interact with this vulnerability:

#### 👍 Reply with this to acknowledge and accept the identified risk.
```text
/accept I accept the risk of this vulnerability, because ...
```

#### ⚠️ Mark the risk as false positive: Use one of these commands if you believe the reported vulnerability is not actually a valid issue.
```text
/component-not-present The vulnerable component is not included in the artifact.
```
```text
/vulnerable-code-not-present The component is present, but the vulnerable code is not included or compiled.
```
```text
/vulnerable-code-not-in-execute-path The vulnerable code exists, but is never executed at runtime.
```
```text
/vulnerable-code-cannot-be-controlled-by-adversary Built-in protections prevent exploitation of this vulnerability.
```
```text
/inline-mitigations-already-exist The vulnerable code cannot be controlled or influenced by an attacker.
```

#### 🔁 Reopen the risk: Use this command to reopen a previously closed or accepted vulnerability.
```text
/reopen ... 
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GHSA-hmw2-7cc7-3qxx found in npm/form-data@4.0.5 #152