jest-environment-jsdom-29.7.0.tgz: 2 vulnerabilities (highest severity is: 8.7) #8
Description
Vulnerable Library - jest-environment-jsdom-29.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 106e853ed865122563f01f3abe24af9f610a74e6
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (jest-environment-jsdom version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2025-7783 |  High |
8.7 | form-data-4.0.0.tgz | Transitive | 30.0.0 | ❌ |
| CVE-2026-3449 |  Low |
3.3 | once-2.0.0.tgz | Transitive | 30.0.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2025-7783
Vulnerable Library - form-data-4.0.0.tgz
A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.
Library home page: https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- jest-environment-jsdom-29.7.0.tgz (Root Library)
- jsdom-20.0.3.tgz
- ❌ form-data-4.0.0.tgz (Vulnerable Library)
- jsdom-20.0.3.tgz
Found in HEAD commit: 106e853ed865122563f01f3abe24af9f610a74e6
Found in base branch: main
Vulnerability Details
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-07-18
URL: CVE-2025-7783
CVSS 3 Score Details (8.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-fjxv-7rqg-78g4
Release Date: 2025-07-18
Fix Resolution (form-data): 4.0.4
Direct dependency fix Resolution (jest-environment-jsdom): 30.0.0
Step up your Open Source Security Game with Mend here
CVE-2026-3449
Vulnerable Library - once-2.0.0.tgz
Creates a Promise that waits for a single event
Library home page: https://registry.npmjs.org/@tootallnate/once/-/once-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- jest-environment-jsdom-29.7.0.tgz (Root Library)
- jsdom-20.0.3.tgz
- http-proxy-agent-5.0.0.tgz
- ❌ once-2.0.0.tgz (Vulnerable Library)
- http-proxy-agent-5.0.0.tgz
- jsdom-20.0.3.tgz
Found in HEAD commit: 106e853ed865122563f01f3abe24af9f610a74e6
Found in base branch: main
Vulnerability Details
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
Publish Date: 2026-03-03
URL: CVE-2026-3449
CVSS 3 Score Details (3.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-03
Fix Resolution (@tootallnate/once): 3.0.1
Direct dependency fix Resolution (jest-environment-jsdom): 30.0.0
Step up your Open Source Security Game with Mend here