CoreCVE
Back

CRITICAL

Usage of unsafe random function in form-data for choosing boundary

Published Jul 18, 2025

Description

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.

This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Affected products

Remediation

Red Hat statement

This flaw does not affect host systems. The impact of this vulnerability is limited to specific applications which integrate the `form-data` library. As a result the impact of this CVE is limited on RedHat systems.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-330

Insufficient Randomness

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner harborist
Published Jul 18, 2025
Updated Nov 3, 2025
Reserved Jul 18, 2025
Link CVE-2025-7783
CISA Vulnrichment
Updated Jul 22, 2025
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2025-7783
Red Hat
Severity Moderate
Public date Jul 18, 2025
Links CVE-2025-7783 - Bugzilla
ENISA EUVD
Assigner harborist
Published Jul 18, 2025
Updated Nov 3, 2025
Exploited since n/a
Link EUVD-2025-21906
EUVD-2025-21906 GHSA-FJXV-7RQG-78G4