{"id":"CVE-2025-7783","aliases":["AZL-65606","AZL-65610","CLSA-2026-1773101683","CLSA-2026-1773188144","CLSA-2026-1774743810","CLSA-2026-1774743825","CLSA-2026-1774743826","CLSA-2026-1776818195","CLSA-2026-1776818216","CLSA-2026-1777941829","CLSA-2026-1781484836","CLSA-2026-1781484855","CLSA-2026-1793098686","DEBIAN-CVE-2025-7783","DLA-4261-1","EUVD-2025-21906","GHSA-fjxv-7rqg-78g4","OESA-2025-2204","OESA-2025-2205","OESA-2025-2206","OESA-2025-2207","OESA-2025-2208","OESA-2025-2276","ROOT-APP-NPM-CVE-2025-7783","SUSE-SU-2025:3919-1","UBUNTU-CVE-2025-7783","USN-7976-1","openSUSE-SU-2025:15373-1","openSUSE-SU-2025:15380-1","openSUSE-SU-2026:11126-1","openSUSE-SU-2026:11680-1","openSUSE-SU-2026:21448-1"],"status":"published","title":"Usage of unsafe random function in form-data for choosing boundary","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0181,"percentile":0.78765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-330"],"published":"2025-07-18T16:34:44Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"benweissmann/CVE-2025-7783-poc","title":"benweissmann/CVE-2025-7783-poc","date":"2025-07-18","url":"https://github.com/benweissmann/CVE-2025-7783-poc"}],"fixes":[{"ecosystem":"npm","package":"form-data","fixed_in":["2.5.4","3.0.4","4.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"form-data","fixed_in":["0.2.0-tuxcare.1","1.0.0-rc3-tuxcare.1","0.0.8-tuxcare.1","2.3.3-tuxcare.1","0.1.4-tuxcare.1","2.0.0-tuxcare.1","2.1.4-tuxcare.1","1.0.1-tuxcare.1","4.0.0-tuxcare.1","4.0.1-tuxcare.1","4.0.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-form-data","fixed_in":["4.0.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-form-data","fixed_in":["4.0.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-form-data","fixed_in":["4.0.1-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"node-form-data","fixed_in":["3.0.0-2+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nodejs-form-data","fixed_in":["0.2.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"form-data","fixed_in":["2.3.2-aikido.1","4.0.2-aikido.2","2.3.3-aikido.2","4.0.0-aikido.2","3.0.1-aikido.2","4.0.1-aikido.2","2.3.3-aikido.3","2.5.1-aikido.1","3.0.2-aikido.1","3.0.2-aikido.2","4.0.4-aikido.2","2.3.3-aikido.4","3.0.1-aikido.3","4.0.0-aikido.3","4.0.1-aikido.3","3.0.1-aikido.4","3.0.3-aikido.1","3.0.3-aikido.2","4.0.2-aikido.3","4.0.4-aikido.1","3.0.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/form-data","fixed_in":["3.0.1-root.io.1","4.0.0-root.io.1","2.3.3-root.io.1","4.0.2-root.io.1","4.0.1-root.io.1","2.3.2-root.io.1","2.5.1-root.io.1","4.0.2-root.io.2","2.3.3-root.io.2","4.0.0-root.io.2","3.0.1-root.io.2","4.0.1-root.io.2","2.3.3-root.io.3","3.0.2-root.io.1","4.0.4-root.io.2","3.0.2-root.io.2","2.3.3-root.io.4","3.0.1-root.io.3","4.0.0-root.io.3","4.0.1-root.io.3","3.0.1-root.io.4","3.0.3-root.io.1","3.0.3-root.io.2","4.0.2-root.io.3","4.0.4-root.io.1","3.0.4-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","fixed_in":["18.20.8-8.41.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-form-data","fixed_in":["0.1.0-1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-form-data","fixed_in":["0.1.0-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-form-data","fixed_in":["0.1.0-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-form-data","fixed_in":["3.0.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-form-data","fixed_in":["3.0.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"node-form-data","fixed_in":["4.0.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-jupyterlab-templates","fixed_in":["0.5.2-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-nbdime","fixed_in":["4.0.2-21.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0-tuxcare.0"},{"fixed":"0.2.0-tuxcare.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-rc3-tuxcare.0"},{"fixed":"1.0.0-rc3-tuxcare.1"}]}],"versions":["1.0.0-rc3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.8-tuxcare.0"},{"fixed":"0.0.8-tuxcare.1"}]}],"versions":["0.0.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.1"}]}],"versions":["2.3.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.4-tuxcare.0"},{"fixed":"0.1.4-tuxcare.1"}]}],"versions":["0.1.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4-tuxcare.0"},{"fixed":"2.1.4-tuxcare.1"}]}],"versions":["2.1.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.1-tuxcare.0"},{"fixed":"1.0.1-tuxcare.1"}]}],"versions":["1.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-tuxcare.0"},{"fixed":"4.0.0-tuxcare.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.1"}]}],"versions":["4.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.2-tuxcare.0"},{"fixed":"4.0.2-tuxcare.2"}]}],"versions":["4.0.2","4.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1+deb12u1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-2+deb11u1"}]}],"versions":["3.0.0-2"]},{"source":"osv","ecosystem":"npm","package":"form-data","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.4"}]}]},{"source":"osv","ecosystem":"npm","package":"form-data","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]},{"source":"osv","ecosystem":"npm","package":"form-data","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-aikido.1"},{"fixed":"4.0.2-aikido.2"},{"fixed":"2.3.3-aikido.2"},{"fixed":"4.0.0-aikido.2"},{"fixed":"3.0.1-aikido.2"},{"fixed":"4.0.1-aikido.2"},{"fixed":"2.3.3-aikido.3"},{"fixed":"2.5.1-aikido.1"},{"fixed":"3.0.2-aikido.1"},{"fixed":"3.0.2-aikido.2"},{"fixed":"4.0.4-aikido.2"},{"fixed":"2.3.3-aikido.4"},{"fixed":"3.0.1-aikido.3"},{"fixed":"4.0.0-aikido.3"},{"fixed":"4.0.1-aikido.3"},{"fixed":"3.0.1-aikido.4"},{"fixed":"3.0.3-aikido.1"},{"fixed":"3.0.3-aikido.2"},{"fixed":"4.0.2-aikido.3"},{"fixed":"4.0.4-aikido.1"},{"fixed":"3.0.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-root.io.1"},{"fixed":"4.0.0-root.io.1"},{"fixed":"2.3.3-root.io.1"},{"fixed":"4.0.2-root.io.1"},{"fixed":"4.0.1-root.io.1"},{"fixed":"2.3.2-root.io.1"},{"fixed":"2.5.1-root.io.1"},{"fixed":"4.0.2-root.io.2"},{"fixed":"2.3.3-root.io.2"},{"fixed":"4.0.0-root.io.2"},{"fixed":"3.0.1-root.io.2"},{"fixed":"4.0.1-root.io.2"},{"fixed":"2.3.3-root.io.3"},{"fixed":"3.0.2-root.io.1"},{"fixed":"4.0.4-root.io.2"},{"fixed":"3.0.2-root.io.2"},{"fixed":"2.3.3-root.io.4"},{"fixed":"3.0.1-root.io.3"},{"fixed":"4.0.0-root.io.3"},{"fixed":"4.0.1-root.io.3"},{"fixed":"3.0.1-root.io.4"},{"fixed":"3.0.3-root.io.1"},{"fixed":"3.0.3-root.io.2"},{"fixed":"4.0.2-root.io.3"},{"fixed":"4.0.4-root.io.1"},{"fixed":"3.0.4-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.8-8.41.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.14.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-2ubuntu0.1~esm1"}]}],"versions":["2.3.2-4","2.5.1-1","3.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm1"}]}],"versions":["3.0.0-2","3.0.0-4","3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.14.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.16.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-1ubuntu0.18.04.1~esm1"}]}],"versions":["0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-2ubuntu0.1~esm1"}]}],"versions":["2.3.2-4","2.5.1-1","3.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1ubuntu0.1~esm1"}]}],"versions":["3.0.0-2","3.0.0-4","3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-form-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu0.1"}]}],"versions":["4.0.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-jupyterlab-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-nbdime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+673.b97ba64d6-160000.12.1"}]}],"bundled":13}],"references":[{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","tags":["third-party-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","tags":["patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7783","tags":["web","advisory"]},{"url":"https://github.com/benweissmann/CVE-2025-7783-poc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4"},{"url":"https://npmjs.com/form-data","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7783.json","tags":["advisory"]},{"url":"https://github.com/form-data/form-data","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-7783","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2204","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2205","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2206","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2207","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2208","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2276","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253919-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246818","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-7783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-7783","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7976-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://bugzilla.suse.com/1246822","tags":["report"]},{"url":"https://bugzilla.suse.com/1259169","tags":["report"]},{"url":"https://bugzilla.suse.com/1268851","tags":["report"]},{"url":"https://bugzilla.suse.com/1269359","tags":["report"]},{"url":"https://bugzilla.suse.com/1269514","tags":["report"]},{"url":"https://bugzilla.suse.com/1269595","tags":["report"]},{"url":"https://bugzilla.suse.com/1269927","tags":["report"]},{"url":"https://bugzilla.suse.com/1272310","tags":["report"]},{"url":"https://bugzilla.suse.com/1272311","tags":["report"]},{"url":"https://bugzilla.suse.com/1272312","tags":["report"]},{"url":"https://bugzilla.suse.com/1272313","tags":["report"]},{"url":"https://bugzilla.suse.com/1272317","tags":["report"]},{"url":"https://bugzilla.suse.com/1272318","tags":["report"]},{"url":"https://bugzilla.suse.com/1272319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54490","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-7783","title":"Usage of unsafe random function in form-data for choosing boundary","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T16:34:44.889Z","modified":"2025-11-03T20:07:41.307Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-21906","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T16:34:44Z","modified":"2025-11-03T20:07:41Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-fjxv-7rqg-78g4","title":"form-data uses unsafe random function in form-data for choosing boundary","description":"### Summary\n\nform-data uses `Math.random()` to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:\n1. can observe other values produced by Math.random in the target application, and\n2. can control one field of a request made using form-data\n\nBecause the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.\n\nThis is largely the same vulnerability as was [recently found in `undici`](https://hackerone.com/reports/2913312) by [`parrot409`](https://hackerone.com/parrot409?type=user) -- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.\n\n### Details\n\nThe culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347\n\nAn attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a `x-request-id` header added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend. `Math.random()` is a fine place to get these sorts of IDs (in fact, [opentelemetry uses Math.random for this purpose](https://github.com/open-telemetry/opentelemetry-js/blob/2053f0d3a44631ade77ea04f656056a2c8a2ae76/packages/opentelemetry-sdk-trace-base/src/platform/node/RandomIdGenerator.ts#L22))\n\n### PoC\n\nPoC here: https://github.com/benweissmann/CVE-2025-7783-poc\n\nInstructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID). \n\n### Impact\n\nFor an application to be vulnerable, it must:\n- Use `form-data` to send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)\n- Reveal values of Math.random(). It's easiest if the attacker can observe multiple sequential values, but more complex math could recover the PRNG state to some degree of confidence with non-sequential values. \n\nIf an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.","status":"published","published":"2025-07-21T19:04:54Z","modified":"2025-11-03T21:34:09Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-7783","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T17:15:44.747Z","modified":"2026-06-17T10:05:39.033Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-7783","title":"Usage of unsafe random function in form-data for choosing boundary","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T16:34:44.889Z","modified":"2026-10-28T02:30:30.5593575Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-7783","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.  This issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T17:15:44.747Z","modified":"2026-09-01T20:05:59.369221458Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-fjxv-7rqg-78g4","title":"form-data uses unsafe random function in form-data for choosing boundary","description":"### Summary\n\nform-data uses `Math.random()` to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:\n1. can observe other values produced by Math.random in the target application, and\n2. can control one field of a request made using form-data\n\nBecause the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.\n\nThis is largely the same vulnerability as was [recently found in `undici`](https://hackerone.com/reports/2913312) by [`parrot409`](https://hackerone.com/parrot409?type=user) -- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.\n\n### Details\n\nThe culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347\n\nAn attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a `x-request-id` header added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend. `Math.random()` is a fine place to get these sorts of IDs (in fact, [opentelemetry uses Math.random for this purpose](https://github.com/open-telemetry/opentelemetry-js/blob/2053f0d3a44631ade77ea04f656056a2c8a2ae76/packages/opentelemetry-sdk-trace-base/src/platform/node/RandomIdGenerator.ts#L22))\n\n### PoC\n\nPoC here: https://github.com/benweissmann/CVE-2025-7783-poc\n\nInstructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID). \n\n### Impact\n\nFor an application to be vulnerable, it must:\n- Use `form-data` to send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)\n- Reveal values of Math.random(). It's easiest if the attacker can observe multiple sequential values, but more complex math could recover the PRNG state to some degree of confidence with non-sequential values. \n\nIf an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.","status":"published","published":"2025-07-21T19:04:54Z","modified":"2026-09-10T03:50:57.924154051Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"OESA-2025-2204","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:11.160462707Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2205","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.164701431Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2206","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.109151793Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2207","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:09.892411697Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2208","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-05T11:09:17Z","modified":"2026-08-18T01:18:11.169275951Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2276","title":"nodejs-form-data security update","description":"A module to create readable \u0026amp;quot;multipart/form-data\u0026amp;quot; streams.  Can be used to submit forms and file uploads to other web applications.\r\n\r\nSecurity Fix(es):\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.(CVE-2025-7783)","status":"published","published":"2025-09-12T11:09:21Z","modified":"2026-08-18T01:19:10.190554409Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"ROOT-APP-NPM-CVE-2025-7783","title":"CVE-2025-7783 in form-data - Patched by Root","description":"Root has patched CVE-2025-7783 in the form-data package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-28T11:34:14Z","modified":"2026-09-28T12:15:02.992657588Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2025-7783","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. This issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T17:15:00Z","modified":"2026-02-04T02:29:00.208584Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-65606","title":"CVE-2025-7783 affecting package js-jquery 3.5.0-4","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T17:15:44Z","modified":"2026-04-21T04:37:38.871459Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65610","title":"CVE-2025-7783 affecting package js-jquery 3.5.0-4","description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","status":"published","published":"2025-07-18T17:15:44Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"CLSA-2026-1773101683","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.152051949Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773188144","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.0-rc3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T13:57:56.657545994Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743810","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.0.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.463753728Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743825","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.466012899Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743826","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 0.1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.457315519Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776818195","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:45.777878344Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776818216","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:45.774147193Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777941829","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 1.0.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:45:50.390187045Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1781484836","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:50.838322339Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781484855","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:47:50.853285027Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1793098686","title":"TuxCare security update for form-data (1 CVE)","description":"TuxCare rebuilt form-data to address 1 CVE. Fixed in 4.0.2-tuxcare.2.","status":"published","published":"2026-10-27T10:58:06Z","modified":"2026-10-27T13:30:16.632949878Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"DLA-4261-1","title":"node-form-data - security update","status":"published","published":"2025-07-31T00:00:00Z","modified":"2026-03-09T02:10:25.171135Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2025:15373-1","title":"jupyter-jupyterlab-templates-0.5.2-3.1 on GA media","description":"These are all security issues fixed in the jupyter-jupyterlab-templates-0.5.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-23T00:00:00Z","modified":"2026-03-23T04:53:41.865622Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15380-1","title":"jupyter-nbdime-7.0.2-21.1 on GA media","description":"These are all security issues fixed in the jupyter-nbdime-7.0.2-21.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-24T00:00:00Z","modified":"2025-07-25T20:30:38.613513Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21448-1","title":"Security update for agama-web-ui","description":"This update for agama-web-ui fixes the following issues:\n\n- CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for multipart\n  form-encoded data (bsc#1246822).\n- CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).\n- CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when processing\n  non-expanding `{}` brace groups (bsc#1269927).\n- CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially crafted strings\n  (bsc#1269359).\n- CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for\n  HTTP-family URLs (bsc#1269595).\n- CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and `_.isEqual`\n  functions (bsc#1259169).\n- CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//` being\n  reinterpreted as protocol-relative URLs (bsc#1272311).\n- CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317).\n- CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document\n  (bsc#1268851).\n- CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).\n- CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).\n- CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).\n- CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path substring\n  matching (bsc#1272318).\n","status":"published","published":"2026-07-27T15:55:38Z","modified":"2026-07-29T18:24:28.648555524Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:3919-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n  - CVE-2025-7783: Switched away from Math.random() in boundary values for multipart form-encoded data (bsc#1246818)\n","status":"published","published":"2025-11-03T10:32:00Z","modified":"2025-11-04T16:19:16.881015Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-7976-1","title":"node-form-data vulnerability","description":"Ben Shonaldmann discovered that Form-data incorrectly generated boundary\nvalues for multipart form-encoded data, leading to predictable values. A\nremote attacker could possibly use this issue to make arbitrary requests\nto internal systems.","status":"published","published":"2026-01-26T11:00:44Z","modified":"2026-06-25T13:32:31.654170241Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}