Critical Predictable Boundary Vulnerability in Axios via form-data
Summary
GHSA-rm8p-cx58-hcvx: Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data. Affects axios versions >= 1.10.0, < 1.11.0. Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from node.js or XMLHttpRequests from the browser. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library is widely adopted due to its promise-based architecture and ease of use. However, a critical vulnerability has been identified in its transitive dependency, form-data, which can lead to serious security risks.
Vulnerability Detail
A critical vulnerability exists in the form-data package used by axios@1.10.0. This issue arises from the use of non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings. This predictability allows attackers to exploit HTTP parameter pollution or injection attacks, potentially interfering with multipart request parsing and injecting unintended parameters. The flaw is tracked under CVE-2025-7783 and can significantly impact any application using axios@1.10.0 to submit multipart form-data.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0
This is the first release that contains the fix.
npm install axios@1.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using axios@1.10.0 for multipart form-data requests until you can update to a patched version. Alternatively, consider using a different library for handling multipart requests that does not rely on the vulnerable form-data package.
Conclusion
In summary, a critical vulnerability has been identified in the form-data package used by axios@1.10.0, which can lead to significant security risks. It is crucial for developers to update to axios version 1.11.0 or later to protect their applications from potential exploitation. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for axios →
FAQ
The vulnerability is a predictable boundary value issue in the form-data package used by axios, which can lead to HTTP parameter pollution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Attackers could interfere with multipart request parsing, inject unintended parameters, and exploit backend deserialization logic depending on content boundaries.
Yes, the patch is available in axios version 1.11.0 and later. It is recommended to update to this version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for axios.
