Vulnerability · Published Jul 18, 2025 · Assigned by harborist
CVE-2025-7783Usage of unsafe random function in form-data for choosing boundary
Critical 9.4
In plain English
A critical-severity weak randomness in form-data. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)1.8%top 21.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-form-data | 4.0.0-1+deb12u1 | DEBIAN-CVE-2025-7783 |
| Debian:13 | node-form-data | 4.0.1-2 | DEBIAN-CVE-2025-7783 |
| Debian:14 | node-form-data | 4.0.1-2 | DEBIAN-CVE-2025-7783 |
| Ubuntu:24.04:LTS | node-form-data | 4.0.0-1ubuntu0.1 | UBUNTU-CVE-2025-7783 |
| npm | form-data | 3.0.4 | GHSA-fjxv-7rqg-78g4 |
| npm | form-data | 4.0.4 | GHSA-fjxv-7rqg-78g4 |
| npm | form-data | 2.5.4 | GHSA-fjxv-7rqg-78g4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| form-data | < 2.5.43.0.0 - 3.0.34.0.0 - 4.0.3 |
Weakness: CWE-330 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N