CVE-2025-7783: 
JavaScript vulnerability analysis and mitigation

CVE-2025-7783 is a Use of Insufficiently Random Values vulnerability in the form-data npm library that enables HTTP Parameter Pollution (HPP) attacks. The flaw resides in lib/form_data.js, where Math.random() is used to generate multipart boundary values — a cryptographically weak PRNG. Affected versions are form-data < 2.5.4, 3.0.0–3.0.3, and 4.0.0–4.0.3. It was disclosed on July 18, 2025, with patched versions released the same day. The vulnerability carries a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-330: Use of Insufficiently Random Values) is the use of Math.random() in the _generateBoundary() function of lib/form_data.js to construct the 24-character hex suffix of multipart form boundaries (e.g., boundary += Math.floor(Math.random() * 10).toString(16)). Because V8's Math.random() is a deterministic PRNG (xorshift128+), an attacker who can observe a small number of sequential Math.random() outputs — for example, from x-request-id headers or other application-generated random values — can reconstruct the PRNG state and predict future boundary values. With a predicted boundary, the attacker can craft a user-controlled field value that embeds the boundary string, injecting additional, fully attacker-controlled form fields into the multipart request sent by the vulnerable application to a downstream system. The fix replaces Math.random() with crypto.randomBytes(12).toString('hex'), providing cryptographically secure randomness (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject arbitrary additional parameters into multipart form requests made by the vulnerable application to internal or third-party systems, effectively bypassing application-level access controls. Depending on how the downstream system handles duplicate parameters (overwrite vs. array), the attacker may be able to overwrite sensitive fields such as is_admin or other privilege-controlling parameters, leading to unauthorized privilege escalation or data manipulation. Both confidentiality and integrity of the vulnerable and subsequent systems are rated High, with potential for lateral movement to internal services that trust the application's outbound requests (GitHub Advisory).

1. Reconnaissance: Identify target applications that use a vulnerable version of form-data (< 2.5.4, 3.0.0–3.0.3, or 4.0.0–4.0.3) and send multipart form data to downstream systems. Check npm dependency manifests or package-lock.json files if accessible.
2. Observe Math.random() outputs: Find a side-channel in the target application that exposes Math.random() values — common examples include x-request-id or distributed tracing headers (e.g., OpenTelemetry trace IDs), or by triggering the application to make outbound form-data requests to an attacker-controlled server (e.g., via a user-controlled webhook), then observing the multipart boundary values in those requests.
3. Recover PRNG state: Use a tool such as the predict-v8-randomness npm package (used in the PoC) to feed the observed sequential Math.random() outputs and reconstruct the V8 xorshift128+ PRNG state.
4. Predict future boundary: Use the recovered PRNG state to predict the next 24 Math.random() outputs that will be used to generate the form-data boundary string for the target request.
5. Craft malicious payload: Construct a user-controlled field value that embeds the predicted boundary string followed by a crafted Content-Disposition header and attacker-controlled field (e.g., is_admin: true), formatted as a valid multipart segment terminator.
6. Submit the request: Submit the crafted payload as a legitimate user input to the vulnerable application. When the application forwards the multipart request to the downstream system, the injected boundary causes the downstream parser to interpret the attacker's injected field as a separate, legitimate form parameter.
7. Achieve objective: Depending on the downstream system's parameter handling, the attacker's injected field may overwrite or append to existing parameters, potentially granting elevated privileges or manipulating application logic (GitHub Advisory, PoC).

• Network: Outbound multipart HTTP requests from the application server to internal or third-party systems where the Content-Type: multipart/form-data; boundary= value matches a predictable pattern (24 hex digits derived from Math.random()); unexpected webhook or callback requests from the application to attacker-controlled external hosts.
• Logs: Application access logs showing repeated requests to endpoints that trigger outbound form-data requests, particularly from a single source IP; downstream system logs showing unexpected duplicate or overriding form parameters (e.g., is_admin=true) in multipart requests originating from the application.
• Application Behavior: Downstream systems receiving multipart requests with unexpected additional fields not submitted by the end user; privilege escalation events in systems that receive form data from the vulnerable application.
• Dependency Audit: Presence of form-data versions < 2.5.4, 3.0.0–3.0.3, or 4.0.0–4.0.3 in node_modules/form-data/package.json or package-lock.json (GitHub Advisory).

Upgrade form-data to a patched version: 2.5.4, 3.0.4, or 4.0.4. The fix replaces Math.random() with crypto.randomBytes(12).toString('hex') for boundary generation, ensuring cryptographic randomness. As an interim measure, implement network-level monitoring for HTTP Parameter Pollution patterns in outbound multipart requests. Red Hat has issued errata (RHSA-2025:14919, RHSA-2025:16101, RHSA-2025:16113, RHSA-2025:18278, RHSA-2025:18744) for affected products including Cryostat 4, multicluster engine for Kubernetes, and Red Hat Advanced Cluster Management. IBM, HPE, Dell, Atlassian, Qlik, and other vendors have also released product-specific advisories (GitHub Advisory, Fix Commit, Red Hat Bugzilla).

The vulnerability received notable coverage from security media outlets including GBHackers, CyberSecurityNews, CyberPress, and The Hacker News (weekly recap), with headlines emphasizing that millions of applications using the widely-deployed form-data npm package were potentially exposed. Security researchers on Mastodon and Bluesky (e.g., @lambdawatchdog, @cR0w) discussed the vulnerability shortly after disclosure. The advisory credits researcher benweissmann for discovery and notes the similarity to a prior undici vulnerability found by parrot409 (HackerOne report #2913312). Qlik published a community support update specifically addressing CVE-2025-7783 in Qlik Sense, and Cloudflare added WAF rules for the vulnerability (GitHub Advisory, Qlik Community).