CVE-2025-54371: Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data
7.5
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | = 1.10.0 | 1.11.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is not in the Axios codebase itself, but in a transitive dependency, form-data. The vulnerability lies in the form-data package's use of Math.random() for generating multipart boundaries, which is predictable. The fix applied to Axios was to update the form-data dependency from version 4.0.0 to 4.0.4 in package.json and package-lock.json. This is evident from the commit 53c1606737e2b8c541b5c1dc801180cda4313961. Since the flaw is not in Axios's own functions, no vulnerable functions from the axios package can be identified. The exploitation would occur when an application uses axios to send multipart form data, which in turn calls the vulnerable code within the form-data library. Without analyzing the form-data package's source code, it is not possible to identify the specific vulnerable function.