Critical Math.random() flaw in form-data JavaScript library enables request injection attacks

A critical vulnerability his reported in the form-data JavaScript library that could lead to remote code execution and data exfiltration. The form-data library is used in the JavaScript ecosystem for handling file uploads and form submissions, making this vulnerability particularly concerning for enterprise applications and cloud services.

The vulnerability is tracked as CVE-2025-7783 (CVSS score 9.4), and is caused by the use of Math.random() to generate boundary values in multipart form-data requests—an approach that exposes applications to predictable and exploitable behavior under certain conditions.

Form-Data versions prior to the patch use this line of code: 

boundary += Math.floor(Math.random() * 10).toString(16), 

which creates predictable boundary values because Math.random() is not cryptographically secure and its output can be reverse-engineered if an attacker observes a sequence of values. An attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. 

Successful exploitation requires two conditions to be met: 

1. The attacker must be able to observe Math.random() values, such as via headers like x-request-id or other telemetry/tracing mechanisms (e.g., OpenTelemetry uses Math.random).
2. The attacker must control part of the payload sent using the Form-Data library. 

These conditions are frequently met in modern microservices architectures that implement distributed tracing, request correlation, or webhook processing systems.

Affected Versions:

• < 2.5.4
• 3.0.0 – 3.0.3
• 4.0.0 – 4.0.3

Patched Versions:

• 2.5.4
• 3.0.4
• 4.0.4

The patches replace Math.random() with cryptographically secure random number generation, eliminating the predictability that enables boundary value prediction attacks. Developers and DevOps teams are urged to immediately update to the latest versions to mitigate the issue.