Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| form-data | npm | < 2.5.4 | 2.5.4 |
| form-data | npm | >= 3.0.0, < 3.0.4 | 3.0.4 |
| form-data | npm | >= 4.0.0, < 4.0.4 | 4.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the predictable nature of Math.random() used for generating the multipart boundary in the form-data library. The provided commit patch clearly shows the modification in the FormData.prototype._generateBoundary function within lib/form_data.js. The vulnerable implementation, which uses a loop with Math.random(), was replaced with a call to crypto.randomBytes(), a cryptographically secure random number generator. This change directly addresses the core of the vulnerability. An attacker exploiting this flaw could predict the boundary, craft a payload that includes this boundary, and thereby inject additional, unauthorized parameters into the form data. This could lead to various security impacts, such as privilege escalation or data manipulation, depending on how the receiving server processes the multipart form data.
