Security: Fix CVE-2025-7783 (form-data Unsafe Random Function)

[vmrh21]

Date: 2026-02-26

Summary

This PR fixes CVE-2025-7783 (form-data unsafe random function) by adding npm override to force form-data ^4.0.5 across all transitive dependencies.

CVE Details

• CVE ID: CVE-2025-7783
• Package: form-data
• Severity: CRITICAL (CVSS 9.1)
• Vulnerability: Unsafe random function for boundary selection in multipart/form-data
• Impact: Predictable boundary values could allow attackers to inject malicious content or bypass security controls
• Vulnerable versions: 3.0.0 - 3.0.3
• Fixed version: 4.0.5

Test Results ✅

Status: All tests passed
Test Framework: npm scripts (run-s test:backend test:frontend)
Test command: npm test
Exit code: 0
Duration: <10 minutes

Test Summary

• Backend tests: ✅ PASSED
• Frontend tests: ✅ PASSED
• Multipart form functionality: ✅ Working
• Regressions: None detected

Fix Method

Approach: npm overrides with major version upgrade (3.x → 4.x)

• form-data is a transitive dependency (used by jsdom in test environment)
• Important: Test-only dependency, not in production builds
• Single override in root package.json forces all instances to use fixed version
• Follows repository best practices from .cve-fix/examples.md

Files Changed (4 total):

• package.json (added override)
• package-lock.json
• backend/package-lock.json
• frontend/package-lock.json

Breaking Changes

None - only used in test environment, all tests passed

API Changes in form-data 4.x:

• Constructor signature unchanged for basic usage
• Stream handling improvements (backward compatible)
• Boundary generation now uses cryptographically secure random (security fix)
• TypeScript types improved (no runtime impact)

Impact: Zero impact on production since form-data is only used in test environment (jsdom dependency)

Testing Checklist

• Pre-PR automated tests executed and passed
• Verified form-data@4.0.5 via npm list
• Confirmed CVE no longer in npm audit
• All monorepo lock files updated (root, backend, frontend)
• Multipart form functionality in tests working
• Build succeeds in CI/CD pipeline

Risk Assessment

Risk Factor	Level	Notes
Breaking Changes	LOW	Only used in test environment, all tests passed
Dependency Conflicts	LOW	Compatible with jsdom and jest
Regression Risk	LOW	All tests passed, no code changes
Deployment Impact	NONE	Test-only dependency, not in production build

Overall Risk: LOW

Note: form-data is only used in the test environment (jsdom), making this fix extremely low risk for production deployments.

Verification Steps

1. Verify CVE is resolved:

   npm audit | grep form-data
   # Expected: (empty - CVE resolved)

2. Verify version:

   npm list form-data
   # Expected: form-data@4.0.5 overridden

3. Run tests:

   npm test
   # Expected: All tests pass

---

🤖 Generated by CVE Fixer Workflow
📋 Fix implementation report: artifacts/cve-fixer/fixes/fix-implementation-CVE-2025-7783.md

[vmrh21]

Closing for fresh test run