CVE-2025-7783 Usage of unsafe random function in form-data for choosing boundary
An attacker can exploit insufficient randomness in boundary generation to perform HTTP Parameter Pollution attacks against applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-7783?
CVE-2025-7783 is a critical vulnerability in form-data, published on 18 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Weakness: CWE-330
Which versions are affected by CVE-2025-7783?
6 open source packages ship an affected version, including form-data.
| Package | Affected | Fixed in |
|---|---|---|
form-data npm | All versions | 2.5.4 |
form-data npm | All versions | 2.5.4 |
form-data npm | From 3.0.0 | 3.0.4 |
form-data npm | From 3.0.0 | 3.0.4 |
form-data npm | From 4.0.0 | 4.0.4 |
form-data npm | From 4.0.0 | 4.0.4 |
Linux distribution packages (3)
nodejs18 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 18.20.8-8.41.1 |
python-jupyterlab-templates openSUSE:Tumbleweed | All versions | 0.5.2-3.1 |
python-nbdime openSUSE:Tumbleweed | All versions | 4.0.2-21.1 |
How do I fix CVE-2025-7783?
Upgrade form-data to a fixed version for your release line: 2.5.4, 3.0.4 or 4.0.4.
Is CVE-2025-7783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-7783 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-65606, AZL-65610, CLEANSTART-2026-IW41585, CLEANSTART-2026-VM42011, CLEANSTART-2026-ZB76140, CLSA-2026-1773101683 and 32 more.