Summary
A critical vulnerability exists in the form-data package used by axios@1.10.0. The issue allows an attacker to predict multipart boundary values generated using Math.random(), opening the door to HTTP parameter pollution or injection attacks.
This was submitted in issue #6969 and addressed in pull request #6970.
Details
The vulnerable package form-data@4.0.0 is used by axios@1.10.0 as a transitive dependency. It uses non-secure, deterministic randomness (Math.random()) to generate multipart boundary strings.
This flaw is tracked under Snyk Advisory SNYK-JS-FORMDATA-10841150 and CVE-2025-7783.
Affected form-data versions:
- <2.5.4
-
=3.0.0 <3.0.4
-
=4.0.0 <4.0.4
Since axios@1.10.0 pulls in form-data@4.0.0, it is exposed to this issue.
PoC
- Install Axios: -
npm install axios@1.10.0
2.Run snyk test:
Tested 104 dependencies for known issues, found 1 issue, 1 vulnerable path.
✗ Predictable Value Range from Previous Values [Critical Severity]
in form-data@4.0.0 via axios@1.10.0 > form-data@4.0.0
- Trigger a multipart/form-data request. Observe the boundary header uses predictable random values, which could be exploited in a targeted environment.
Impact
- Vulnerability Type: Predictable Value / HTTP Parameter Pollution
- Risk: Critical (CVSS 9.4)
- Impacted Users: Any application using axios@1.10.0 to submit multipart form-data
This could potentially allow attackers to:
- Interfere with multipart request parsing
- Inject unintended parameters
- Exploit backend deserialization logic depending on content boundaries
Related Links
GitHub Issue #6969
Pull Request #xxxx (replace with actual link)
Snyk Advisory
form-data on npm
Miggo AI