Security: Upgrade vulnerable form-data dependency (CVE-2025-7783) #167
Description
This project currently depends on a version of the form-data library that is affected by a critical security vulnerability (CVE-2025-7783). This CVE is tied to the use of insufficiently random boundary values in form-data, which can lead to HTTP Parameter Pollution and potential security exploitation in applications that process multipart form uploads.
Vulnerability Details
- CVE: CVE-2025-7783
- Affected Package: form-data+
- Affected Versions: 4.0.0 through 4.0.3, as well as earlier vulnerable releases.
- Severity: Critical (e.g., CVSS ~9.4 reported by CNA and third-party trackers)
- Description: The form-data library uses predictable values for multipart boundary generation, enabling an attacker to predict and manipulate form boundaries. This may be leveraged to cause HTTP Parameter Pollution (HPP) or related multipart manipulation attacks.