The vulnerability, assigned CVE-2025-7783, stems from the library’s use of the predictable Math.random() function to generate boundary values for multipart form-encoded data, allowing attackers to manipulate HTTP requests and inject malicious parameters into backend systems. Additionally, security teams should review applications for other instances where Math.random() values might be observable to potential attackers, as this represents a broader class of vulnerability beyond the specific form-data issue. Security researchers have demonstrated that by observing other Math.random() values produced by the target application, attackers can determine the PRNG state and predict future boundary values with high accuracy. This implementation uses JavaScript’s Math.random() function, which generates pseudo-random numbers that are predictable when an attacker can observe sequential values from the same pseudo-random number generator (PRNG) state. Common scenarios include applications that generate request IDs using Math.random() for distributed tracing, similar to how OpenTelemetry implements random ID generation for correlation across frontend and backend systems. The patches replace the predictable Math.random() implementation with cryptographically secure random number generation for boundary value creation. form-data library uses predictable Math.random(), enabling parameter injection attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 23 Jul 2025 13:35:05 +0000