CVE-2025-7783: form-data Package Boundary Value Vulnerability
Summary
CVE-2025-7783: form-data uses unsafe random function in form-data for choosing boundary. Affects form-data across 3 version ranges.
< 2.5.4
>= 3.0.0, < 3.0.4
>= 4.0.0, < 4.0.4
Fixed in 2.5.4, 3.0.4 or 4.0.4, depending on the release line you run. How to fix ↓
Also tracked for
- node-form-data · Debian:11
The same CVE-2025-7783 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The form-data package is a popular npm library used for constructing multipart/form-data streams, which are essential for uploading files and data in web applications. It simplifies the process of sending data to servers, particularly in scenarios involving file uploads. However, a critical vulnerability has been identified in how it generates boundary values for multipart requests, making it susceptible to attacks that can manipulate request parameters.
Vulnerability Detail
The vulnerability arises from the use of Math.random() to select boundary values for multipart form-encoded data. This method is predictable and can be exploited by an attacker who can observe the output of Math.random() in the application. If an attacker can control a field in a request made using form-data and has access to sequential Math.random() values, they can predict the boundary value and inject additional parameters into the request. This could lead to unauthorized data manipulation or injection attacks, effectively allowing the attacker to craft malicious requests.
How To Fix
Latest published version: 4.0.6 as of 22 Oct 2026
npm install form-data@4.0.6Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.42.5.4npm install form-data@2.5.4 -
>= 3.0.0, < 3.0.43.0.4npm install form-data@3.0.4 -
>= 4.0.0, < 4.0.44.0.4npm install form-data@4.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of Math.random() for generating boundary values in your application. Instead, implement a more secure random number generator or use a library designed for cryptographic purposes to ensure unpredictability.
Conclusion
The CVE-2025-7783 vulnerability in the form-data package poses a significant risk due to its reliance on Math.random() for generating boundary values. It is crucial for developers to update to the patched versions of the package to protect their applications from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for form-data →
FAQ
CVE-2025-7783 is a vulnerability in the form-data package that allows attackers to predict boundary values used in multipart form data, potentially leading to unauthorized data manipulation.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If exploited, this vulnerability can allow attackers to inject additional parameters into requests, leading to unauthorized access or manipulation of data.
You can update the form-data package by running the following command in your terminal: npm install form-data@<version>, replacing <version> with 2.5.4, 3.0.4, or 4.0.4 as appropriate.
While updating is the best solution, you can temporarily mitigate the vulnerability by avoiding the use of Math.random() for generating boundary values and using a more secure random number generator.
References
Related vulnerabilities
Recent vulnerabilities recorded for form-data.
