Vulnerability-Lookup

CVE-2025-7783 (GCVE-0-2025-7783)

Vulnerability from cvelistv5 – Published: 2025-07-18 16:34 – Updated: 2025-11-03 20:07

Title

Usage of unsafe random function in form-data for choosing boundary

Summary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-22 14:54 UTC

CWE

CWE-330 - Use of Insufficiently Random Values

Assigner

harborist CNA under the redhat root

CNA scorecard B 85/100 over 12 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/form-data/form-data/security/a…	third-party-advisory
https://github.com/form-data/form-data/commit/3d1…	patch
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version	CPE status
		Affected: < 2.5.4 (semver) Affected: 3.0.0 - 3.0.3 (semver) Affected: 4.0.0 - 4.0.3 (semver)

Credits

https://github.com/benweissmann https://github.com/benweissmann https://github.com/ljharb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7783",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:54:27.721309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:54:31.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:07:41.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://npmjs.com/form-data",
          "defaultStatus": "unaffected",
          "packageName": "form-data",
          "programFiles": [
            "lib/form_data.js"
          ],
          "repo": "https://github.com/form-data/form-data",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.0.0 - 3.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0 - 4.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/benweissmann"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/benweissmann"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "https://github.com/ljharb"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003elib/form_data.Js\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-460",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330 Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T16:34:44.889Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Usage of unsafe random function in form-data for choosing boundary",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2025-7783",
    "datePublished": "2025-07-18T16:34:44.889Z",
    "dateReserved": "2025-07-18T04:34:56.939Z",
    "dateUpdated": "2025-11-03T20:07:41.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-7783",
      "date": "2026-10-14",
      "epss": "0.0191",
      "percentile": "0.79372"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:22:31.000Z",
      "cve": "CVE-2025-7783",
      "id": "msrc_CVE-2025-7783",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Usage of unsafe random function in form-data for choosing boundary",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-7783.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://npmjs.com/form-data",
                "defaultStatus": "unaffected",
                "packageName": "form-data",
                "programFiles": [
                  "lib/form_data.js"
                ],
                "repo": "https://github.com/form-data/form-data",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.5.4",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "3.0.0 - 3.0.3",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "4.0.0 - 4.0.3",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de uso de valores insuficientemente aleatorios en form-data permite la contaminaci\u00f3n de par\u00e1metros HTTP (HPP). Esta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/form_data.Js. Este problema afecta a form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3."
          }
        ],
        "id": "CVE-2025-7783",
        "lastModified": "2026-06-17T10:05:39.033",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-7783",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:54:27.721309Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-18T17:15:44.747",
        "references": [
          {
            "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
            "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
          },
          {
            "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
            "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
          }
        ],
        "sourceIdentifier": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-330"
              }
            ],
            "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T22:49:39+00:00",
      "cve": "CVE-2025-7783",
      "id": "CVE-2025-7783",
      "initial_release_date": "2025-07-18T16:34:44.889000+00:00",
      "product_status:fixed": "197",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "1017",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "form-data: Unsafe random function in form-data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-7783.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:07:41.307Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-7783",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-07-22T14:54:27.721309Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-22T14:54:21.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://npmjs.com/form-data",
              "defaultStatus": "unaffected",
              "packageName": "form-data",
              "programFiles": [
                "lib/form_data.js"
              ],
              "repo": "https://github.com/form-data/form-data",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.5.4",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "3.0.0 - 3.0.3",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "4.0.0 - 4.0.3",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "https://github.com/benweissmann"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "https://github.com/benweissmann"
            },
            {
              "lang": "en",
              "type": "remediation reviewer",
              "value": "https://github.com/ljharb"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003elib/form_data.Js\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\u003c/p\u003e"
                }
              ],
              "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-460",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-330",
                  "description": "CWE-330 Use of Insufficiently Random Values",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-07-18T16:34:44.889Z",
            "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
            "shortName": "harborist"
          },
          "references": [
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Usage of unsafe random function in form-data for choosing boundary",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "assignerShortName": "harborist",
        "cveId": "CVE-2025-7783",
        "datePublished": "2025-07-18T16:34:44.889Z",
        "dateReserved": "2025-07-18T04:34:56.939Z",
        "dateUpdated": "2025-11-03T20:07:41.307Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2026:2737

Vulnerability from csaf_redhat - Published: 2026-02-16 12:56 - Updated: 2026-10-14 19:32

Summary

Red Hat Security Advisory: Red Hat Ceph Storage

Severity

Important

Scope

18 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Fixed: 4 products Known not affected: 20 products

https://access.redhat.com/errata/RHSA-2026:2737

Open the full advisory

RHSA-2026:2800

Vulnerability from csaf_redhat - Published: 2026-02-17 09:23 - Updated: 2026-10-14 19:32

Summary

Red Hat Security Advisory: Red Hat Ceph Storage

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Fixed: 4 products Known not affected: 15 products

https://access.redhat.com/errata/RHSA-2026:2800

Open the full advisory

RHSA-2026:3406

Vulnerability from csaf_redhat - Published: 2026-02-26 07:14 - Updated: 2026-10-14 19:34

Summary

Red Hat Security Advisory: New container image: rhceph-9.0

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Fixed: 4 products Known not affected: 20 products

https://access.redhat.com/errata/RHSA-2026:3406

Open the full advisory

RHSA-2026:41928

Vulnerability from csaf_redhat - Published: 2026-07-20 08:34 - Updated: 2026-10-14 19:37

Summary

Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

Severity

Important

Scope

58 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Fixed: 1 product Known not affected: 10 products

https://access.redhat.com/errata/RHSA-2026:41928

Open the full advisory

RHSA-2026:59439

Vulnerability from csaf_redhat - Published: 2026-08-25 13:53 - Updated: 2026-10-14 05:03

Summary

Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Fixed: 1 product Known not affected: 9 products

https://access.redhat.com/errata/RHSA-2026:59439

Open the full advisory

SSA-485750

Vulnerability from csaf_siemens - Published: 2026-03-10 00:00 - Updated: 2026-03-10 00:00

Summary

SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800

Scope

23 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Known affected: 1 product

Open the full advisory

SUSE-SU-2025:3919-1

Vulnerability from csaf_suse - Published: 2025-11-03 10:32 - Updated: 2026-09-20 18:26

Summary

Security update for nodejs18

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2025-7783.

CVE-2025-7783

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Recommended: 16 products

Open the full advisory

UBUNTU-CVE-2025-7783 (CVE-2025-7783)

Vulnerability from osv_ubuntu – Published: 2025-07-18 17:15 – Updated: 2026-01-30 05:36 – Source website

Details

Severity

9.4 (Critical)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-7783	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-7783	REPORT
	https://github.com/form-data/form-data/security/a…	REPORT
	https://github.com/form-data/form-data/commit/3d1…	REPORT
	https://ubuntu.com/security/notices/USN-7976-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "0.1.0-1ubuntu0.14.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@0.1.0-1ubuntu0.14.04.1~esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0-1ubuntu0.14.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "0.1.0-1ubuntu0.16.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@0.1.0-1ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0-1ubuntu0.16.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "0.1.0-1ubuntu0.18.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@0.1.0-1ubuntu0.18.04.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.0-1ubuntu0.18.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "3.0.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@3.0.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.2-4",
        "2.5.1-1",
        "3.0.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "3.0.1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@3.0.1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-2",
        "3.0.0-4",
        "3.0.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "node-form-data",
            "binary_version": "4.0.0-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-form-data",
        "purl": "pkg:deb/ubuntu/node-form-data@4.0.0-1ubuntu0.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. This issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
  "id": "UBUNTU-CVE-2025-7783",
  "modified": "2026-01-30T05:36:41Z",
  "published": "2025-07-18T17:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-7783"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7783"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7976-1"
    }
  ],
  "related": [
    "USN-7976-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-7783"
  ]
}

WID-SEC-W-2025-1854

Vulnerability from csaf_certbund - Published: 2025-08-17 22:00 - Updated: 2025-10-12 22:00

Summary

HCL BigFix Komponente: Mehrere Schwachstellen

Severity

Hoch

Scope

9 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

Known affected: 2 products

Open the full advisory

WID-SEC-W-2025-1929

Vulnerability from csaf_certbund - Published: 2025-08-28 22:00 - Updated: 2026-01-25 23:00

Summary

IBM App Connect Enterprise: Mehrere Schwachstellen

Severity

Hoch

Scope

3 vulnerabilities in this advisory, including CVE-2025-7783.

CVE-2025-7783

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-7783 (GCVE-0-2025-7783)

UBUNTU-CVE-2025-7783 (CVE-2025-7783)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour