Levandor

CVE-2025-7783 — critical form-data CVE inherited by every customization branch using `request`

3 min read

A critical advisory in form-data@2.3.3 reaches the tree through the EOL request@2.88.2, which hard-pins it. It is absent from devel but red on every customization branch that still calls request — so it blocks any partner branch adopting devel’s expanded CI pipeline.

The advisory

FieldValue
CVE / GHSACVE-2025-7783 / GHSA-fjxv-7rqg-78g4
Packageform-data@2.3.3
SeverityCritical
IssueUnsafe random function used to generate the multipart boundary
Patched in>= 2.5.4
Reaches tree viarequest@2.88.2 → hard-pins form-data: ~2.3.2

request is end-of-life and will never bump that pin. The advisory therefore cannot resolve itself through a normal dependency refresh.

Why devel is green but partner branches are red

devel’s Audit job is green — request is not in devel’s tree. The dependency is live partner code:

RepoCall sites
vuer_osscustomization/api/sms/SmsCofidis.js
vuer_csscustomization/server/web/api/login.endpoint.js, register.endpoint.js, partner-register.endpoint.js

Confirmed red on:

  • customization/cofidis — vuer_css #3100, vuer_oss #8040
  • customization/kh — #3098
  • customization/raiffeisen — #8055

It will block every partner branch that adopts the new pipeline

Partner branches only started running an audit job once they took a devel merge — see customization-branch-ci-pipeline-inheritance. Every remaining partner branch on request will hit this on its first devel-update.

Fix pattern (matches existing house style)

Add a Yarn resolutions override in package.json, then regenerate the lock:

"resolutions": {
  "request/form-data": "^2.5.6"
}
yarn install

The repos already use resolutions for exactly this purpose — existing entries pin csurf/cookie, twig/minimatch and ts-jest/handlebars. This is the low-friction, precedented fix.

Long-term fix is a separate ticket

The correct remediation is dropping EOL request entirely, which requires rewriting the 4–5 call sites above. That is out of scope for a devel-update PR — file it separately.

Gotcha — the yarn audit parse errors are cosmetic

Do not chase the parse error; find the real advisory

In the Audit job these two lines are red herrings:

ERROR: Unable to parse yarn audit output: SyntaxError ...
(node:…) [DEP0169] DeprecationWarning: url.parse() ...

improved-yarn-audit merges the child process’s stdout and stderr into one NDJSON stream, so Node 24’s DEP0169 deprecation warning corrupts some lines. The tool then silently skips every line it cannot parse.

These identical errors appear on green devel runs. Proof: vuer_oss PR #8062, job 87891787317 — same parse errors, Found 0 vulnerabilities, conclusion success.

The job’s exit code comes solely from the genuine advisory count. An initial diagnosis during FKITDEV-9059 mis-attributed the failure to the parse error before deeper checking corrected it.

Graph View

Backlinks