Critical Vulnerability in node-form-data Package: Insufficiently Random Values Leading to HTTP Parameter Pollution
Summary
DEBIAN-CVE-2025-7783: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). Affects node-form-data versions < 3.0.0-2+deb11u1. Fixed in 3.0.0-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-form-data package is a widely used library in Node.js applications that facilitates the creation of form data for HTTP requests. It allows developers to easily construct and send form data, including files, to web servers. However, this package has been identified to have a vulnerability that affects its ability to generate sufficiently random values, which can lead to security issues, particularly HTTP Parameter Pollution (HPP). This vulnerability is present in versions prior to 2.5.4, as well as in specific ranges of versions 3.0.0 to 3.0.3 and 4.0.0 to 4.0.3.
Vulnerability Detail
The vulnerability arises from the use of insufficiently random values in the form-data library, which can be exploited through HTTP Parameter Pollution (HPP). This allows an attacker to manipulate HTTP requests by injecting additional parameters, potentially leading to unauthorized access or data manipulation. The issue is rooted in the program files located in lib/form_data.js, affecting various versions of the package across multiple Debian releases.
How To Fix
Minimum fixed version
3.0.0-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-form-dataTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider validating and sanitizing all incoming HTTP parameters to mitigate the risk of HPP attacks. This can be done by implementing middleware in your application that checks for unexpected parameters and rejects requests that contain them.
Conclusion
The node-form-data package has a critical vulnerability due to insufficiently random values, leading to potential HTTP Parameter Pollution attacks. It is crucial to update to the patched versions provided for your specific Debian release to mitigate this risk. Additionally, implementing workarounds can help protect your application until updates are applied.
See every vulnerability recorded for node-form-data →
FAQ
HTTP Parameter Pollution (HPP) is a type of attack where an attacker manipulates HTTP requests by injecting additional parameters, potentially leading to unauthorized access or data manipulation.
The vulnerability affects versions of node-form-data prior to 2.5.4, as well as versions 3.0.0 to 3.0.3 and 4.0.0 to 4.0.3.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check if your application is affected.
If immediate updates are not possible, implement input validation and sanitization to mitigate the risk of HPP attacks as a temporary workaround.
Yes, using tools like Vulert can help automate the monitoring and alerting process for vulnerabilities, ensuring that you are informed about necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-form-data.
