This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	1.10.0 -> 1.11.0

GitHub Vulnerability Alerts

GHSA-rm8p-cx58-hcvx

Summary

A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.

This was submitted in issue #​6969 and addressed in pull request #​6970.

Details

The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.

This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.

Affected form-data versions:

• <2.5.4

• =3.0.0 <3.0.4

• =4.0.0 <4.0.4

Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.

PoC

1. Install Axios: - npm install axios@1.10.0
   2.Run snyk test:

Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.

✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0

3. Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.

Impact

• Vulnerability Type: Predictable Value / HTTP Parameter Pollution
• Risk: Critical (CVSS 9.4)
• Impacted Users: Any application using axios@1.10.0 to submit multipart form-data

This could potentially allow attackers to:

• Interfere with multipart request parsing
• Inject unintended parameters
• Exploit backend deserialization logic depending on content boundaries

Related Links

GitHub Issue #​6969

Pull Request #xxxx (replace with actual link)

Snyk Advisory

form-data on npm

Release Notes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.