This might be a false positive, but demos/react18/cra/package-lock.json around line 8348 looked worth a second pair of eyes.
The form-data package v3.0.1 generates multipart boundaries using insufficiently random values, creating an HTTP Parameter Pollution (HPP) vector. Attackers can exploit predictable boundary sequences to manipulate HTTP requests, pollute parameters, bypass input validation, or facilitate request smuggling/forgery. Given its CRITICAL severity and direct impact on form-upload workflows, this poses a severe risk requiring immediate patching.
Something like this might fix it:
Update the form-data dependency to the patched version in your package manifest.
--- a/demos/react18/cra/package.json
+++ b/demos/react18/cra/package.json
@@ -X,X +X,X @@
- "form-data": "^3.0.1",
+ "form-data": "^3.0.4",
Execute `npm install` to regenerate package-lock.json with the fixed version, then verify remediation with `npm audit`.
For reference: rule CVE-2025-7783. Rated critical.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
demos/react18/cra/package-lock.jsonaround line 8348 looked worth a second pair of eyes.The form-data package v3.0.1 generates multipart boundaries using insufficiently random values, creating an HTTP Parameter Pollution (HPP) vector. Attackers can exploit predictable boundary sequences to manipulate HTTP requests, pollute parameters, bypass input validation, or facilitate request smuggling/forgery. Given its CRITICAL severity and direct impact on form-upload workflows, this poses a severe risk requiring immediate patching.
Something like this might fix it:
For reference: rule
CVE-2025-7783. Rated critical.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.