Skip to content

Commit 19b7c15

Browse files
Fix security issue in form-data via minor version upgrade from 2.5.2 to 2.5.4 (#194)
This PR will resolve the following CVEs: | CVE ID | Severity | Description | | --- | --- | --- | | <pre>[CVE-2025-7783](https://app.aikido.dev/issues/13367485/detail?groupId=324#CVE-2025-7783)</pre> | <pre>MEDIUM</pre> | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.<br><br>This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. | Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com>
1 parent 1d7add4 commit 19b7c15

2 files changed

Lines changed: 163 additions & 12 deletions

File tree

package-lock.json

Lines changed: 161 additions & 11 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@
9292
},
9393
"overrides": {
9494
"undici@<=6.21.2": "6.21.2",
95-
"brace-expansion@<=1.1.12": "1.1.12"
95+
"brace-expansion@<=1.1.12": "1.1.12",
96+
"form-data@<=2.5.4": "2.5.4"
9697
}
9798
}

0 commit comments

Comments
 (0)