Summary
form-data versions 4.0.0–4.0.5 contain a CRLF injection vulnerability where unescaped field names and filenames are written directly into the multipart boundary without sanitization. The backend lockfile has form-data@4.0.4 (vulnerable).
Vulnerability Details
- Package: form-data
- Vulnerable range: 4.0.0–4.0.5
- Fixed in: >=4.0.6
- Severity: High
- Type: CRLF Injection
- Dependency path: likely via axios or other HTTP client dependencies
Risk
An attacker who can control field names or filenames in multipart form data can inject arbitrary HTTP headers via CRLF sequences. This can be used to manipulate request headers sent to downstream services, potentially leading to HTTP request smuggling or header injection in calls to the SMB API.
Recommendation
Update form-data to >=4.0.6. If it is a transitive dependency, update the parent dependency (e.g., axios):
npm install axios@latest
npm audit fix
Verify:
npm ls form-data
npm audit --audit-level=high
Related Issues
Summary
form-dataversions 4.0.0–4.0.5 contain a CRLF injection vulnerability where unescaped field names and filenames are written directly into the multipart boundary without sanitization. The backend lockfile hasform-data@4.0.4(vulnerable).Vulnerability Details
Risk
An attacker who can control field names or filenames in multipart form data can inject arbitrary HTTP headers via CRLF sequences. This can be used to manipulate request headers sent to downstream services, potentially leading to HTTP request smuggling or header injection in calls to the SMB API.
Recommendation
Update
form-datato >=4.0.6. If it is a transitive dependency, update the parent dependency (e.g., axios):Verify:
Related Issues