CVE catalog
CVE-2025-7783
Form-Data vulnerability
- Severity
- High · CVSS 8.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.81% · Oct 25, 2026
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-form-data | sid | 4.0.6+~2.1.0-1 | fixed |
| Debian | node-form-data | forky | 4.0.6+~2.1.0-1 | fixed |
| Debian | node-form-data | trixie | 4.0.1-2 | fixed |
| Debian | node-form-data | bookworm | 4.0.0-1+deb12u1 | fixed |
| Ubuntu | node-form-data | noble | 4.0.0-1ubuntu0.1 | fixed |
| Npm | form-data | Not reported | 4.0.4 | fixed |
| Npm | form-data | Not reported | 3.0.4 | fixed |
| Npm | form-data | Not reported | 4.0.4 | fixed |
| Opensuse | agama-web-ui | tumbleweed | 24+0.a836cced5-52.1 | fixed |
| Opensuse | agama-web-ui | leap 16.0 | 17+673.b97ba64d6-160000.12.1 | fixed |
| Ubuntu | node-form-data | pro | 3.0.0-2 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.0-4 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.1-1 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.1-1ubuntu0.1~esm1 | fixed |
| Ubuntu | node-form-data | 24.04 | 4.0.0-1 | vulnerable |
| Ubuntu | node-form-data | 24.04 | 4.0.0-1ubuntu0.1 | fixed |
| Opensuse | python-jupyterlab-templates | tumbleweed | 0.5.2-3.1 | fixed |
| Ubuntu | node-form-data | pro | 3.0.0-2 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.0-4 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.1-1 | vulnerable |
| Ubuntu | node-form-data | pro | 3.0.1-1ubuntu0.1~esm1 | fixed |
| Ubuntu | node-form-data | 24.04 | 4.0.0-1 | vulnerable |
| Ubuntu | node-form-data | 24.04 | 4.0.0-1ubuntu0.1 | fixed |
| Suse | nodejs18 | linux enterprise server ltss extended security 12 sp5 | 18.20.8-8.41.1 | fixed |
| Opensuse | python-nbdime | tumbleweed | 4.0.2-21.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-form-data | source | sid | 4.0.1-2 | not yet assigned | Not reported | [1109551] |
| Debian | node-form-data | source | forky | 4.0.1-2 | not yet assigned | Not reported | [1109551] |
| Debian | node-form-data | source | trixie | 4.0.1-2 | not yet assigned | Not reported | [1109551] |
| Debian | node-form-data | source | bookworm | 4.0.0-1+deb12u1 | not yet assigned | Not reported | [1109551] |
| Ubuntu | node-form-data | deb | noble | 4.0.0-1ubuntu0.1 | Not reported | Not reported | Not reported |
| Npm | form-data | npm | Not reported | 4.0.4 | Not reported | GHSA-FJXV-7RQG-78G4 | Not reported |
| Npm | form-data | npm | Not reported | 3.0.4 | Not reported | Not reported | Not reported |
| Npm | form-data | npm | Not reported | 4.0.4 | Not reported | Not reported | Not reported |
| Opensuse | agama-web-ui | rpm | tumbleweed | 24+0.a836cced5-52.1 | Not reported | OPENSUSE-SU-2026:11680-1 | Not reported |
| Opensuse | agama-web-ui | rpm | leap 16.0 | 17+673.b97ba64d6-160000.12.1 | Not reported | OPENSUSE-SU-2026:21448-1 | Not reported |
| Ubuntu | node-form-data | deb | pro | 3.0.1-1ubuntu0.1~esm1 | Not reported | USN-7976-1 | Not reported |
| Ubuntu | node-form-data | deb | 24.04 | 4.0.0-1ubuntu0.1 | Not reported | USN-7976-1 | Not reported |
| Opensuse | python-jupyterlab-templates | rpm | tumbleweed | 0.5.2-3.1 | Not reported | OPENSUSE-SU-2025:15373-1 | Not reported |
| Ubuntu | node-form-data | deb | pro | 3.0.1-1ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2025-7783 | Not reported |
| Ubuntu | node-form-data | deb | 24.04 | 4.0.0-1ubuntu0.1 | Not reported | UBUNTU-CVE-2025-7783 | Not reported |
| Suse | nodejs18 | rpm | linux enterprise server ltss extended security 12 sp5 | 18.20.8-8.41.1 | Not reported | SUSE-SU-2025:3919-1 | Not reported |
| Opensuse | python-nbdime | rpm | tumbleweed | 4.0.2-21.1 | Not reported | OPENSUSE-SU-2025:15380-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [agama-web-ui]Affected
Source package: [agama-web-ui]
Details (1)
23+278.4096bc82f-51.1· noarch · tumbleweedAffected · Fixed:
24+0.a836cced5-52.1usn · agama-web-ui · opensuse · tumbleweed
- [jupyter-jupyterlab-templates]Unknown
Source package: [python-jupyterlab-templates]
Details (1)
0.5.3-2.3· noarch · tumbleweedUnknown · Fixed:
0.5.2-3.1Version impact unknown
usn · python-jupyterlab-templates · opensuse · tumbleweed
- [jupyter-nbdime]Unknown
Source package: [python-nbdime]
Details (1)
7.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [jupyter-nbdime-jupyterlab]Unknown
Source package: [python-nbdime]
Details (1)
3.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python313-jupyterlab-templates]Unknown
Source package: [python-jupyterlab-templates]
Details (1)
0.5.3-2.3· noarch · tumbleweedUnknown · Fixed:
0.5.2-3.1Version impact unknown
usn · python-jupyterlab-templates · opensuse · tumbleweed
- [python313-nbdime]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python313-nbdime-git]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python313-nbdime-hg]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python314-jupyterlab-templates]Unknown
Source package: [python-jupyterlab-templates]
Details (1)
0.5.3-2.3· noarch · tumbleweedUnknown · Fixed:
0.5.2-3.1Version impact unknown
usn · python-jupyterlab-templates · opensuse · tumbleweed
- [python314-nbdime]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python314-nbdime-git]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
- [python314-nbdime-hg]Unknown
Source package: [python-nbdime]
Details (1)
4.0.4-24.1· noarch · tumbleweedUnknown · Fixed:
4.0.2-21.1Version impact unknown
usn · python-nbdime · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [node-form-data]Fixed
Details (2)
4.0.0-1+deb12u1· all · bookwormFixed · Fixed:
4.0.0-1+deb12u1usn · node-form-data · debian · bookworm; usn · node-form-data · debian · 12
4.0.0-1+deb12u1· all · bookwormFixed · Fixed:
4.0.0-1+deb12u1usn · node-form-data · debian · bookworm; usn · node-form-data · debian · 12
[Debian 13 (Trixie)]
- [node-form-data]Fixed
Details (2)
4.0.1-2· all · trixieFixed · Fixed:
4.0.1-2usn · node-form-data · debian · 13
4.0.1-2· all · trixieFixed · Fixed:
4.0.1-2usn · node-form-data · debian · 13
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21448-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-7783]
- [https://osv.dev/vulnerability/DLA-4261-1]
- [https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4]
- [https://osv.dev/vulnerability/SUSE-SU-2025:3919-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-7783]
- [https://osv.dev/vulnerability/USN-7976-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15373-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15380-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11680-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21448-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-7783]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-7783.json]
- [https://ubuntu.com/security/notices/USN-7976-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0559.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]