Description
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | form-data | < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-form-data | 4.0.1-2 | — |
| Debian 13 | node-form-data | 4.0.1-2 | — |
| Debian 12 | node-form-data | 4.0.0-1+deb12u1 | — |
| Debian 11 | node-form-data | 3.0.0-2+deb11u1 | DLA-4261-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | node-form-data | 4.0.0-1ubuntu0.1 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | node-form-data | 3.0.1-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | node-form-data | 3.0.0-2ubuntu0.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | node-form-data | 0.1.0-1ubuntu0.18.04.1~esm1 | — |
| Ubuntu Pro 16.04 LTS | node-form-data | 0.1.0-1ubuntu0.16.04.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | node-form-data | 0.1.0-1ubuntu0.14.04.1~esm1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | nodejs18 | 18.20.8-8.41.1 | SUSE-SU-2025:3919-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
| openSUSE Tumbleweed | python-jupyterlab-templates | 0.5.2-3.1 | openSUSE-SU-2025:15373-1 |
| openSUSE Tumbleweed | python-nbdime | 4.0.2-21.1 | openSUSE-SU-2025:15380-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
| openSUSE Leap 16.0 | agama-web-ui | 17+673.b97ba64d6-160000.12.1 | openSUSE-SU-2026:21448-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | js-jquery | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu +2 | 2.10.0-r4 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r10 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.14.3-r3 | — |
| Wolfi rolling | opensearch-dashboards-3 +13 | 3.1.0-r2 | — |
| Wolfi rolling | prism | 5.14.2-r4 | — |
| Wolfi rolling | sqlpad +1 | 7.5.4-r4 | — |
| Wolfi rolling | tileserver-gl +1 | 5.3.1-r9 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
benweissmann/CVE-2025-7783-poc ★ 32 · Jul 18, 2025
POC of CVE-2025-7783
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | form-data | < 2.5.4 | 2.5.4 | GHSA-fjxv-7rqg-78g4 |
| npm | form-data | >= 3.0.0, < 3.0.4 | 3.0.4 | GHSA-fjxv-7rqg-78g4 |
| npm | form-data | >= 4.0.0, < 4.0.4 | 4.0.4 | GHSA-fjxv-7rqg-78g4 |
Advisories 17
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
- openSUSE-SU-2026:21448-1 Security update for agama-web-ui SUSE / openSUSE Security Updates · Jul 29, 2026
- WID-SEC-2025-2150 Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 19, 2026
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- openSUSE-SU-2025:15373-1 jupyter-jupyterlab-templates-0.5.2-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026
- DLA-4261-1 node-form-data - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0559 IBM Rational Build Forge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 1, 2026
- WID-SEC-2025-1929 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2026-0204 IBM DB2 Big SQL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 22, 2026
- SUSE-SU-2025:3919-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Nov 4, 2025
- WID-SEC-2025-2424 IBM Rational Team Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2025
- WID-SEC-2025-1854 HCL BigFix Komponente: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2025-2165 Qlik Sense: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 5, 2025
- openSUSE-SU-2025:15380-1 jupyter-nbdime-7.0.2-21.1 on GA media SUSE / openSUSE Security Updates · Jul 25, 2025