The form-data library uses the insecure Math.random() function to generate multipart form-data boundaries. Because Math.random() is predictable if an attacker can observe some outputs, an attacker who can observe random values and control a request field can craft requests that inject additional parameters by predicting the boundary value. This vulnerability affects applications using form-data versions prior to 2.5.4, between 3.0.0 and 3.0.4, and between 4.0.0 and 4.0.4. Fixed versions are available. Exploitation requires the ability to observe multiple Math.random() outputs and control part of the form-data content.