Skip to content
Fencer Vulns
critical 9.4

CVE-2025-7783 json

Usage of unsafe random function in form-data for choosing boundary

published 2025-07-18 15 mo ago modified 2026-09-10 1 mo ago also GHSA-fjxv-7rqg-78g4 , EUVD-2025-21906

cvss
9.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.

This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Patch / fix

  • npm form-data 2.5.4, 3.0.4, 4.0.4
  • node-form-data Debian 12 4.0.0-1+deb12u1
  • node-form-data Debian 14, Debian 13 4.0.1-2

debian advisories DEBIAN-CVE-2025-7783

  • node-form-data Ubuntu 24.04 LTS 4.0.0-1ubuntu0.1
  • node-form-data Ubuntu Pro 14.04 LTS 0.1.0-1ubuntu0.14.04.1~esm1
  • node-form-data Ubuntu Pro 16.04 LTS 0.1.0-1ubuntu0.16.04.1~esm1
  • node-form-data Ubuntu Pro 18.04 LTS 0.1.0-1ubuntu0.18.04.1~esm1
  • node-form-data Ubuntu Pro 20.04 LTS 3.0.0-2ubuntu0.1~esm1
  • node-form-data Ubuntu Pro 22.04 LTS 3.0.1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-7783

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs18 SLES LTSS Extended Security 12 SP5 18.20.8-8.41.1

suse advisories SUSE-SU-2025:3919-1

  • agama-web-ui openSUSE Tumbleweed 24+0.a836cced5-52.1
  • agama-web-ui openSUSE Leap 16.0 17+673.b97ba64d6-160000.12.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • python-nbdime openSUSE Tumbleweed 4.0.2-21.1
  • python-jupyterlab-templates openSUSE Tumbleweed 0.5.2-3.1

opensuse advisories openSUSE-SU-2026:11680-1openSUSE-SU-2026:21448-1openSUSE-SU-2026:11126-1openSUSE-SU-2025:15380-1openSUSE-SU-2025:15373-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-7783 updated cvss 5.4

form-data: Unsafe random function in form-data

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, +2 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AMQ Broker 7 org.jolokia-jolokia-parent
    affected: workaround, no fix available
show 19 more
  • Red Hat Ansible Automation Platform 2 automation-hub
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat build of OptaPlanner 8 org.optaweb.vehiclerouting-optaweb-vehicle-routing Red Hat Ceph Storage 6 grafana Red Hat Ceph Storage 7 grafana Red Hat Ceph Storage 8 grafana Red Hat Ceph Storage 9 grafana
    affected: workaround, no fix available
  • Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Discovery 1 discovery/discovery-ui-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-ui-ocp-rhel9 Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 thunderbird Red Hat Enterprise Linux 9 thunderbird Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent
    +1 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhods/odh-dashboard-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/code-rhel9, devspaces/dashboard-rhel8, devspaces/dashboard-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/console-plugin-rhel8, +3 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 org.uberfire-uberfire-parent, org.kie.workbench-kie-wb-common, org.kie-process-migration-service
    affected: workaround, no fix available
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Trusted Artifact Signer rhtas/createtree-rhel9, rhtas/updatetree-rhel9, rhtas/trillian-redis-rhel9, rhtas/trillian-database-rhel9, rhtas/trillian-logserver-rhel9, rhtas/trillian-logsigner-rhel9, +1 more Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix available
  • Red Hat streams for Apache Kafka 2 com.github.streamshub-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.3.1 cluster-observability-operator 1.3.0-1762808264
    fixed: vendor fix RHSA-2025:21146
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.2-3, cryostat/cryostat-db-rhel9 4.0.2-3, cryostat/jfr-datasource-rhel9 4.0.2-3, cryostat/cryostat-reports-rhel9 4.0.2-3, cryostat/cryostat-storage-rhel9 4.0.2-3, cryostat/cryostat-rhel9-operator 4.0.2-3, +5 more
    fixed: vendor fix RHSA-2025:14919
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine
    fixed: vendor fix RHSA-2025:23528
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/cluster-api-rhel9 v2.7.6-3
    fixed: vendor fix RHSA-2025:18278
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine
    fixed: vendor fix RHSA-2025:19332
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2
    fixed: vendor fix RHSA-2025:23529
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/memcached-rhel9 v2.12.5-3
    fixed: vendor fix RHSA-2025:18744
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/memcached-rhel9 v2.13.4-11, rhacm2/acm-flightctl-ui-rhel9 v2.13.4-10, rhacm2/acm-flightctl-api-rhel9 v2.13.4-11, rhacm2/acm-flightctl-ocp-ui-rhel9 v2.13.4-10, rhacm2/acm-flightctl-worker-rhel9 v2.13.4-11, rhacm2/acm-flightctl-periodic-rhel9 v2.13.4-11
    fixed: vendor fix RHSA-2025:16113

13 more fixed, 36 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 8.7

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm form-data
<2.5.4
>=3.0.0, <3.0.4
>=4.0.0, <4.0.4
2.5.4
3.0.4
4.0.4

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.