node-formidable / node-formidable/formidable

Bug: JSON parser incorrectly triggered by "json" in multipart boundary

Open
#1,092 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area: streams bug Type: Bug
Dominant language
JavaScript
Stars
7.2k
Forks
689
Avg merge
3d 7h
Merged PRs (30d)
2

Description

Bug Report: Formidable incorrectly attempts to parse JSON when boundary contains "json" substring

Version: formidable@^3.5.2

Environment: Node.js server

Description:
When the multipart boundary string contains the substring "json" (case-insensitive? - tested with "JsonTestBoundary"), Formidable incorrectly attempts to parse the incoming request body as JSON instead of handling it as multipart/form-data.

Steps to Reproduce:

  1. Server code:
    new Formidable.IncomingForm().parse(req, (err, fields, files) => { if (err) { send(res, form data error: ${err}); return; } });

  2. Client request (curl):
    curl -X POST http://server:3000/body/form/fields -H "Content-Type: multipart/form-data; boundary=----JsonTestBoundary" -d "------JsonTestBoundary\r\nContent-Disposition: form-data; name="arg1"\r\n\r\ntest value\r\n------JsonTestBoundary--\r\n"

Expected Behavior:
The request should be parsed as multipart/form-data successfully, extracting field arg1 with value test value.

Actual Behavior:
Formidable throws a JSON parsing error:
form data error: SyntaxError: Unexpected number in JSON at position 1

Root Cause Analysis:
The boundary string contains the word "json", which appears to trigger Formidable's automatic JSON parsing logic. When "json" is detected anywhere in the boundary, Formidable incorrectly treats the entire request body as JSON rather than respecting the Content-Type: multipart/form-data header.

Workaround:
Avoid using the word "json" in boundary strings. The following boundaries work correctly:

  • ----TestBoundary
  • ----MultipartBoundary
  • ----AnyBoundaryWithoutJson

Suggested Fix:
Formidable should never attempt to parse request body as JSON when Content-Type header is explicitly set to multipart/form-data. The boundary string content should not influence the parsing strategy.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the provided curl request and trace how IncomingForm.parse selects a parser from the Content-Type header and boundary. Verify that a multipart/form-data request with a boundary containing "json" uses the multipart parser, then confirm the arg1 field is extracted successfully and the existing JSON behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.