Critical Security Update for node-form-data: CVE-2025-7783
Summary
DLA-4261-1: node-form-data - security update. Affects node-form-data versions < 3.0.0-2+deb11u1. Fixed in 3.0.0-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-form-data is a popular Node.js module that simplifies the process of creating form data for HTTP requests. It is widely used in applications that need to send data to servers, particularly when dealing with file uploads. This package allows developers to easily append fields and files to a form, making it a crucial component in many web applications. However, like any software, it can be vulnerable to security issues, which can lead to potential exploitation if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2025-7783 affects the node-form-data package, allowing attackers to exploit weaknesses in the way form data is handled. This could lead to unauthorized access or manipulation of data being sent through forms, potentially compromising sensitive information. The issue arises from improper validation and sanitization of input data, which could be leveraged by malicious actors to execute harmful payloads or gain unauthorized access to the system.
How To Fix
Minimum fixed version
3.0.0-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-form-dataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization on your forms to mitigate the risk of exploitation. Ensure that all data being processed is thoroughly checked and cleaned before being used in your application.
Conclusion
The node-form-data package has a critical vulnerability (CVE-2025-7783) that needs immediate attention. Updating to the patched version is crucial to maintaining the security of applications that rely on this package. Implementing workarounds can provide temporary relief, but a permanent fix through an update is highly recommended.
See every vulnerability recorded for node-form-data →
FAQ
CVE-2025-7783 is a security vulnerability in the node-form-data package that can lead to unauthorized access or manipulation of form data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation and sanitization on your forms to reduce the risk of exploitation until you can update the package.
Failure to address this vulnerability could result in unauthorized access to sensitive data, data manipulation, or even complete system compromise.
You can find more information about the node-form-data package on its official repository or documentation pages.
Related vulnerabilities
Recent vulnerabilities recorded for node-form-data.
