Skip to content

chore(deps): update axios to v1.11.0 [security] #2110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 23, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 23, 2025

This PR contains the following updates:

Package Change Age Confidence
axios (source) 1.10.0 -> 1.11.0 age confidence

GitHub Vulnerability Alerts

GHSA-rm8p-cx58-hcvx

Summary

A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.

This was submitted in issue #​6969 and addressed in pull request #​6970.

Details

The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.

This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.

Affected form-data versions:

  • <2.5.4
  • =3.0.0 <3.0.4

  • =4.0.0 <4.0.4

Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.

PoC

  1. Install Axios: - npm install axios@1.10.0
    2.Run snyk test:
Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.

✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0

  1. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.

Impact

  • Vulnerability Type: Predictable Value / HTTP Parameter Pollution
  • Risk: Critical (CVSS 9.4)
  • Impacted Users: Any application using axios@1.10.0 to submit multipart form-data

This could potentially allow attackers to:

  • Interfere with multipart request parsing
  • Inject unintended parameters
  • Exploit backend deserialization logic depending on content boundaries

Related Links

GitHub Issue #​6969

Pull Request #xxxx (replace with actual link)

Snyk Advisory

form-data on npm


Release Notes

axios/axios (axios)

v1.11.0

Compare Source

Bug Fixes
Contributors to this release

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependency Dependency updates label Jul 23, 2025
@github-actions github-actions bot added the chore Miscellaneous tasks label Jul 23, 2025
@setchy setchy added this to the Release 6.6.0 milestone Jul 23, 2025
@setchy setchy merged commit 1df747e into main Jul 23, 2025
9 checks passed
@setchy setchy deleted the renovate/npm-axios-vulnerability branch July 23, 2025 17:16
Copy link

@setchy setchy removed the chore Miscellaneous tasks label Jul 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependency Dependency updates
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant