Insufficiently Random Values Vulnerability in node-form-data: HTTP Parameter Pollution Risk
Summary
CVE-2025-7783: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). Affects node-form-data across 2 version ranges.
< 3.0.0-2+deb11u1
< 3d1723080e6577a66f17f163ecd345a21d8d0fd0
Fixed in 3.0.0-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-form-data is a popular package used in Node.js applications for handling form data, particularly for file uploads. It simplifies the process of constructing form data to be sent via HTTP requests. However, certain versions of this package are vulnerable to an issue that allows attackers to manipulate HTTP parameters, potentially leading to security breaches.
Vulnerability Detail
The vulnerability identified as CVE-2025-7783 stems from the use of insufficiently random values in the node-form-data package. This flaw allows for HTTP Parameter Pollution (HPP), where an attacker can inject malicious parameters into HTTP requests. This can lead to unexpected behavior in the application, including data leakage or unauthorized access. The affected versions are those prior to 2.5.4, as well as 3.0.0 to 3.0.3, and 4.0.0 to 4.0.3.
How To Fix
Minimum fixed version
3.0.0-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-form-dataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize and validate incoming HTTP parameters, ensuring that they conform to expected formats and values. This can help mitigate the risk of HTTP Parameter Pollution until the package is updated.
Conclusion
The CVE-2025-7783 vulnerability in the node-form-data package poses significant risks due to HTTP Parameter Pollution. It is crucial to update to the latest patched version to secure your application. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for node-form-data →
FAQ
CVE-2025-7783 is a vulnerability in the node-form-data package that allows for HTTP Parameter Pollution due to insufficiently random values.
The affected versions are those prior to 2.5.4, as well as 3.0.0 to 3.0.3, and 4.0.0 to 4.0.3.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data leakage, and unexpected application behavior.
If an immediate update is not possible, implement input validation to sanitize HTTP parameters as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for node-form-data.
