Skip to content

Conversation

@mikstew
Copy link
Contributor

@mikstew mikstew commented Aug 20, 2025

Title

bump @redocly/cli version

Description

Vulnerability Details:
CVE: CVE-2025-7783

Severity:
CRITICAL (CVSS 9.4)

Issue:
Use of Insufficiently Random Values in form-data package allowing HTTP Parameter Pollution (HPP)
Affected versions: form-data < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3

Root Cause:
The vulnerability was introduced through the @redocly/cli package (version 1.31.2) which depended on vulnerable versions of form-data:

  • form-data@4.0.0 (vulnerable)
  • form-data@4.0.2 (vulnerable)

Resolution:
Updated @redocly/cli from ^1.31.2 to ^2.0.6 in your root package.json
Verified that the new version uses form-data@^4.0.4 (patched)
Confirmed all vulnerable versions have been removed from pnpm-lock.yaml
Tested that the API validation still works correctly

Current Status:
✅ Vulnerability Resolved: All vulnerable form-data versions have been replaced with the patched form-data@4.0.4
✅ Functionality Preserved: Your API validation and build processes continue to work correctly
✅ No Breaking Changes: The update to @redocly/cli v2.x is backward compatible

The CVE-2025-7783 vulnerability has been completely resolved, and your project is now using secure versions of all dependencies.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • [] New feature (non-breaking change which adds functionality)
  • [] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [] This change requires a documentation update

@danielkhoo danielkhoo merged commit 8dbd75a into master Aug 21, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants