Insufficient Random Values Vulnerability in node-form-data Package: HTTP Parameter Pollution Risk
Summary
UBUNTU-CVE-2025-7783: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). Affects node-form-data versions 0.1.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-form-data package is a popular library used in Node.js applications for handling form data. It simplifies the process of constructing multipart/form-data requests, which are essential for file uploads and form submissions. This package is widely utilized due to its ease of use and integration with various frameworks. However, it has been identified to have a vulnerability related to insufficiently random values, which can lead to security issues if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2025-7783, arises from the use of insufficiently random values in the form-data library. This flaw allows for HTTP Parameter Pollution (HPP), which can be exploited by attackers to manipulate the parameters sent in HTTP requests. The affected versions include form-data versions less than 2.5.4, as well as versions 3.0.0 to 3.0.3 and 4.0.0 to 4.0.3. The ramifications of this vulnerability can lead to unauthorized access, data leakage, or other malicious activities, making it critical for users of the affected package to take immediate action.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize and validate incoming parameters to mitigate the risk of HTTP Parameter Pollution. This can be done by checking for unexpected or malicious parameters in your application code before processing requests.
Conclusion
The node-form-data package has a significant vulnerability (CVE-2025-7783) that can lead to HTTP Parameter Pollution. Users are strongly encouraged to update to the latest version to protect their applications from potential exploitation. Additionally, implementing input validation can serve as a temporary measure to reduce risk.
See every vulnerability recorded for node-form-data →
FAQ
CVE-2025-7783 is a vulnerability in the node-form-data package that allows for HTTP Parameter Pollution due to insufficiently random values.
The affected versions include form-data versions less than 2.5.4, as well as versions 3.0.0 to 3.0.3 and 4.0.0 to 4.0.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The risks include unauthorized access, data leakage, and the potential for attackers to manipulate HTTP requests, leading to various security breaches.
Yes, implementing input validation to sanitize incoming parameters can help mitigate the risk of HTTP Parameter Pollution until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for node-form-data.
