{"id":11439,"date":"2025-07-24T12:23:58","date_gmt":"2025-07-24T05:23:58","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11439"},"modified":"2026-06-25T09:59:17","modified_gmt":"2026-06-25T02:59:17","slug":"vulnerabilities-in-the-javascript-library-that-can-cause-applications-to-be-remotely-controlled","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/24\/vulnerabilities-in-the-javascript-library-that-can-cause-applications-to-be-remotely-controlled\/","title":{"rendered":"Vulnerabilities in the JavaScript library that can cause applications to be remotely controlled"},"content":{"rendered":"

A vulnerability has been detected in a form-data library on npm. With the identifier CVE-2025-7783, this vulnerability affects millions of web applications and APIs using JavaScript\/Node.js globally, especially in backend systems, microservices and serverless.<\/b><\/p>\n

\"1753343397127.png\"<\/a>\u200b<\/div>\n

The root cause comes from an insecure “boundary” generation in the “form_data.js” file, line 347:<\/p>\n

\n
\n
boundary += Math.floor(Math.random() * 10).toString(16);<\/div>\n
Click to expand…<\/a><\/div>\n<\/div>\n<\/blockquote>\n

This will create a boundary line between the data pieces in the multipart\/form-data form. The problem is that Math.random () is not random enough, it’s just a pseudorandom number generator (PRNG), so if the hacker observes some of the values generated from Math. random (), they can predict the next values, including the boundary.<\/p>\n

How does the breach work?<\/h4>\n
    \n
  1. The app uses form-data to send user data as ” multipart\/form-data ” (e. g., photos, registration forms, attachments, etc.).<\/li>\n
  2. At the same time, the application accidentally reveals the Math.random() value, such as via a header such as ” x-request-id “, ” trace-id, ” or debug log.<\/li>\n
  3. The hacker observes these values, and calculates the internal state of the RNG.<\/li>\n
  4. They use it to predict the boundary sequence in subsequent submissions.<\/li>\n
  5. Then, create a malicious packet containing the correct boundary, add rogue parameters, inject malicious data into the internal system, and even illegally access backend APIs.<\/li>\n<\/ol>\n

    Extent of danger and scope of influence<\/h4>\n