Executive brief
form-data is a widely-used Node.js library for handling multipart form data submissions. The library uses an unsafe random number generator (Math.random()) to create boundary values that separate form fields. An attacker who can observe other random values generated by the application (e.g., from request IDs or other sources) can predict the boundary values and inject malicious form fields into requests, potentially allowing them to add unauthorized parameters to requests sent to internal systems.
Technical details
The vulnerability exists in form-data's use of Math.random() to generate multipart form boundary values (specifically at lib/form_data.js line 347). Math.random() is cryptographically weak and its output is predictable if an attacker can observe sequential values. An attacker who can observe other Math.random() outputs from the target application (e.g., from distributed tracing request IDs, or by triggering requests to attacker-controlled endpoints) can solve for the PRNG state and predict future boundary values. With predictable boundaries, an attacker can craft a malicious payload containing the predicted boundary followed by attacker-controlled form fields, effectively injecting additional parameters into multipart requests. This requires network access to observe random values and control over form-data input fields. The attack enables parameter injection into requests sent to internal systems if the downstream handler allows parameter duplication or overwriting.
Affected products
- form-data form-data < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3
Timeline
- 2025-07-18: disclosed: Advisory published by form-data maintainers
- 2025-07-18: patched: Patches released for versions 2.5.4, 3.0.4, and 4.0.4