Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
node-formidable/formidable
master @ d9a251a
5
Fixes
2
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Denial of Service: 2 prior fixes. Scrutinize any change in this area.
src/Formidable.js: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Incomplete directory prefix validation (e.g., matching common prefixes like `/tmp/uploads-evil` against `/tmp/uploads`) allowed attackers to write files to sibling directories of the intended upload directory. Developers must ensure path canonicalization and strict separator-based prefix checks are always enforced.
Denial of Service: Malformed multipart input streams can cause the parser state machine to hang indefinitely instead of throwing an error or terminating. State transitions must explicitly handle unexpected stream ends to prevent CPU exhaustion.
Insecure Randomness: Historically, reliance on hexoid for temporary or uploaded filename generation allowed potential predictability attacks, leading to CVE-2025-46653. Generating filenames must rely on cryptographically secure random values (e.g., cuid2) to prevent guessing.