Skip to content

Security: form-data 4.0.0-4.0.5 CRLF injection via unescaped field names and filenames #278

Description

@LucasMaupin

Summary

form-data versions 4.0.0–4.0.5 contain a CRLF injection vulnerability where unescaped field names and filenames are written directly into the multipart boundary without sanitization. The backend lockfile has form-data@4.0.4 (vulnerable).

Vulnerability Details

  • Package: form-data
  • Vulnerable range: 4.0.0–4.0.5
  • Fixed in: >=4.0.6
  • Severity: High
  • Type: CRLF Injection
  • Dependency path: likely via axios or other HTTP client dependencies

Risk

An attacker who can control field names or filenames in multipart form data can inject arbitrary HTTP headers via CRLF sequences. This can be used to manipulate request headers sent to downstream services, potentially leading to HTTP request smuggling or header injection in calls to the SMB API.

Recommendation

Update form-data to >=4.0.6. If it is a transitive dependency, update the parent dependency (e.g., axios):

npm install axios@latest
npm audit fix

Verify:

npm ls form-data
npm audit --audit-level=high

Related Issues

Metadata

Metadata

Assignees

No one assigned

    Labels

    securitySecurity vulnerability or hardening

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions