CVE-2025-7783
Aliases:GHSA-fjxv-7rqg-78g4DEBIAN-CVE-2025-7783CGA-26f8-ph9r-vp8cCGA-26j2-cphc-x959CGA-2886-8hcf-hfccCGA-2h5v-gmx9-fw7hCGA-2mph-vwrq-8xjhCGA-2pmj-q6m8-6gmxCGA-2qv3-6rgf-r8wqCGA-2v6r-j742-rh6jCGA-2vc4-j66g-qrprCGA-32c5-8m4x-37r6CGA-32xj-7q7c-rcqvCGA-33vc-3383-vwm6CGA-39j3-2xfm-mv2xCGA-3cfw-q7xw-7wh6CGA-3f97-38rj-vhf6CGA-3fpq-x5gg-444wCGA-3fwg-6q58-6fw9CGA-3m3p-8677-8rmjCGA-3mp2-4v6p-67hcCGA-3r2c-jf83-j525CGA-44hg-rwcx-8mw9CGA-47p7-36fj-w5q9CGA-48fg-c2mx-fp98CGA-48rp-74xc-qxx9CGA-4c6v-f4wc-59q8CGA-4j47-rcq9-mvxqCGA-4j7g-cf3p-578wCGA-4p6w-p9xh-289hCGA-4q34-r7q8-84h3CGA-4whc-6cc8-m5jrCGA-4x24-566r-6p33CGA-57f8-cfg7-647rCGA-58cq-gpjv-cw66CGA-59g8-p8qg-v5m4CGA-5g2v-xpr9-j2xjCGA-5wj2-38c9-q3hqCGA-63hf-2f6q-9p4gCGA-665w-gfc6-j85cCGA-67mw-4r9w-pp6wCGA-6gff-2wch-36f7CGA-6jjw-hhxm-h5w4CGA-6pxf-cjpm-87jhCGA-6qv5-6j9x-w6hwCGA-6xv3-j548-28g3CGA-75j6-qw3v-7w6cCGA-75r2-m5fr-xxjcCGA-782x-mv5r-7wp6CGA-7v2m-c67j-98rwCGA-84h5-fcrp-4h73CGA-8784-6wc3-xhwhCGA-89f2-ch5v-wmxrCGA-8p64-f6wr-x4g5CGA-927j-663x-4w4mCGA-92hg-p6x3-f3q7CGA-94w3-ph55-4jc8CGA-9h4j-hjmv-rh65CGA-9vmr-g9g9-m5c9CGA-9x37-q8cg-hrvpCGA-c37g-jg5r-9m62CGA-c4rh-pc35-p33gCGA-c6mc-cwj6-p9hxCGA-c8pq-fc3v-h79xCGA-c9mx-rch3-67xfCGA-cgj9-727h-7r3rCGA-f8qc-4gq6-xw9rCGA-ffgw-p92r-mwqxCGA-fh83-3mj5-v2wpCGA-fmpc-m6pr-9c3jCGA-gch6-hqxc-c26xCGA-gf6x-m7xp-gf5qCGA-gf9x-92r7-wpqrCGA-gxj7-r62c-hjfxCGA-h398-mg44-7mvjCGA-hfh9-gmqf-5jvpCGA-hmjw-6397-r6cxCGA-hr44-7rfv-xq2mCGA-j2fq-3qh5-qhjcCGA-j377-563f-9xg2CGA-j5gp-429r-3j67CGA-jxm6-8c3f-439fCGA-m49w-wcjf-g287CGA-mgm4-86xx-27v5CGA-mjf7-hj84-c6q2CGA-mx3h-972j-6g57CGA-p54j-3g3f-3rjvCGA-p79x-vf5g-wcc3CGA-p8c7-9r77-j3hrCGA-pcgj-2q7q-r9hrCGA-pg52-8jqc-7mwjCGA-pgww-w47p-hg75CGA-pp2w-gmv9-g8rjCGA-prjf-jh42-8qvqCGA-24gp-w6w6-f4fqCGA-24q8-wmr3-v957CGA-258h-8w56-hq2xCGA-269f-25gv-gqf4CGA-26qg-qrmg-2rcgCGA-284j-37w4-3fvgCGA-28qp-ch62-5rw9CGA-297r-gv57-7cf4CGA-29fx-mcxc-grjpCGA-29g2-3pg4-xw2xCGA-2cvx-5vcg-wpj7CGA-2cwp-7gp2-qc3wCGA-2ffv-3vcr-hj9cCGA-2mqf-6cwc-jp5mCGA-2vmg-m34f-q5m5CGA-3743-r5v2-gfg7CGA-38hg-g5jc-x9mxCGA-39cm-gj57-crqcCGA-3fch-q77c-fg6hCGA-3gwh-mhq7-5cgpCGA-3x45-3x75-67g4CGA-43hr-jqr8-5gr3CGA-43wc-mpqc-xcw7CGA-4gcf-8whw-28g6CGA-4ph7-64pq-rv3xCGA-4xmh-rw8x-7q5fCGA-5346-pp26-5mghCGA-5779-c9mg-72jfCGA-5ggg-qhfm-3xffCGA-5q5c-r447-q3qfCGA-6525-865x-xmr6CGA-652j-rr9x-f6v8CGA-66q5-rxq4-vwc6CGA-6748-q8p6-52vwCGA-679c-fhh3-24j4CGA-6929-gfmf-g74mCGA-6qh4-35mf-g3v6CGA-6v6c-rxh8-ghg2CGA-6xr8-jjcc-wq32CGA-73rr-qfr9-p9wxCGA-7596-vq64-r7h2CGA-7877-2xqx-r85gCGA-7hp5-23ch-mq93CGA-7j65-jv68-4rf6CGA-7q3g-6f3f-697wCGA-7qq8-j7cp-7p62CGA-7rrx-9wrv-6893CGA-7vxg-97p3-4r62CGA-83cq-mmgj-v3vcCGA-85c6-36vx-8j57CGA-85jj-vj98-x56fCGA-85mm-4fhh-4jfqCGA-89fp-546c-34q7CGA-89v6-9f63-pqfpCGA-8g6h-f4fp-p828CGA-8pp2-x4jj-6c32CGA-8qrh-v2wg-x776CGA-8qx7-g9pp-3xw8CGA-8vj2-mjpj-f5h3CGA-8x8f-jg2p-vc8mCGA-94r8-2q2f-926fCGA-967f-9ph9-h2cfCGA-968w-qfh2-2pg7CGA-98xf-h322-q5wfCGA-9f8c-pcx8-gqx7CGA-9hm5-c95v-h2mmCGA-9j68-4x36-5rq6CGA-9rjr-v37g-462xCGA-9xhh-79xq-pwcfCGA-c39m-qqjq-r3g5CGA-c3h4-8535-567xCGA-c67g-qp2f-q6x8CGA-c784-x7vm-mfmxCGA-ccf8-mj6g-vvm5CGA-cfv2-m3mx-vf62CGA-cgqj-73rr-7fvjCGA-chvw-fcj2-9rqpCGA-cmqp-3rgh-4w9xCGA-cr2h-jx25-rrmrCGA-cr87-m47h-hrw3CGA-f564-54jg-323rCGA-f67w-rcwr-h8xhCGA-fgh9-2hg2-8mfjCGA-fj6q-g7mp-3p95CGA-fvm7-pvcr-xg3mCGA-fvqq-q2vw-w9jrCGA-fx85-ccx2-63wcCGA-g6rh-6cmc-5569CGA-g8gg-2642-ppq2CGA-gcmf-mqvv-w963CGA-gf52-w43j-cwfxCGA-gmhc-5vqr-33w4CGA-gp7j-vx9q-9f5jCGA-grhr-489r-xmv2CGA-gvmx-p55x-cpr5CGA-gwfq-j4q7-g2h7CGA-h844-7phf-p8h7CGA-h8jp-wg93-jg46CGA-hcqf-9vrr-hfjjCGA-hfrw-cxj3-5c66CGA-hj8m-pxgq-3m8pCGA-hjq8-c7r2-fmpvCGA-hp6x-pgvv-wfhfCGA-hp95-q57x-mv8pCGA-j2v3-qr5f-67xhCGA-j5g7-86mh-89cxCGA-j8gr-m92q-6373CGA-jf6x-h6jc-pgc4CGA-jff2-mhqw-32gcCGA-jfwq-5vxf-wwmgCGA-jgvv-x29q-c9f7CGA-jhrr-jxpw-ppggCGA-jpw7-22h7-2hfrCGA-jr77-8jg5-496mCGA-jv9j-q42x-xjm2CGA-jwmg-mq7x-wfpxCGA-m236-6862-wcrwCGA-m28m-mm32-qppvCGA-m8q4-7qjj-2qvhCGA-m9q6-mfmv-f228CGA-mhf5-g46c-gf5vCGA-mp2p-934c-q74vCGA-mrqh-hc32-2fmqCGA-mvq3-5qcj-52c3CGA-mx24-45gc-9qhwCGA-p3rc-f4v5-r462CGA-p4c2-q72c-6mjvCGA-p4m2-2wjc-w9vwCGA-p622-9433-fpfcCGA-p66j-72gq-hxm4CGA-p8w6-m5mh-gf7fCGA-pf84-76pg-8jp3CGA-pjv6-39j9-2m6fCGA-pmp3-vjh5-5cj2CGA-ppvc-rxxh-49hwCGA-pq3m-mhhc-j9mxCGA-pq6j-hj2f-84jmCGA-pqg9-x4cx-g5fcCGA-pqmr-qpj9-wvjcCGA-q2rr-6w35-gwvwCGA-q3ff-8wq7-8g9pCGA-q3px-pqmr-g729CGA-q5vg-v9jx-93pmCGA-q682-5fm2-gcq3CGA-q699-hgg7-m6wmCGA-q7jp-3938-q5j3CGA-q92h-xq5v-5hqpCGA-q952-9qfq-fxj2CGA-qg5w-whmp-ff56CGA-qhqp-3grc-q8gfCGA-qp2f-25gv-6jw5CGA-qp2x-24wp-6mh2CGA-qq5p-8mf7-px7wCGA-qqqr-g4qv-vc34CGA-r3h3-vf58-pmf8CGA-r4gq-526x-54q5CGA-r588-cqq5-p4m5CGA-r9fm-6vc3-hgrrCGA-r9ww-xpm6-v45pCGA-rcrf-q9f2-v3c4CGA-rg5g-r9r5-4wqwCGA-rggf-cxx4-7q29CGA-rgw7-4w56-pf6vCGA-rm85-h9x2-rx7pCGA-rp3j-7p2v-562xCGA-rq4g-6jrq-9f7gCGA-rqpf-59mh-44hgCGA-rw35-ccfc-725vCGA-rx4p-jm68-p927CGA-v2c5-f59v-pr8jCGA-v64h-gvwf-hjchCGA-vhm3-r8v5-fqw7CGA-vm29-f8xj-jxr3CGA-vppr-xp3h-r569CGA-vpvc-2rv2-6g9cCGA-vqpg-wrwh-5whjCGA-vr89-9vhq-qhqwCGA-vrvq-w3c7-mch2CGA-vv8q-3628-35wgCGA-vw33-52cx-5rq5CGA-vw5g-vv6j-8r3gCGA-w4v7-c5g3-rp8cCGA-w54j-xq2h-q93hCGA-w6qg-6mc9-p5x7CGA-w73q-r4f6-xfr4CGA-w7gf-q2g4-3xrmCGA-w87c-9jh2-9h4jCGA-wc7w-w39p-p5xrCGA-wcmm-ph5w-6652CGA-wgm9-hxgp-q3xmCGA-wh7x-h3qh-7p45CGA-wj36-hh68-x6jxCGA-wj9h-4gc4-q9x2CGA-wjhg-rq7j-4388CGA-wmv6-8cp2-5fh6CGA-wpc6-mqx5-h9w2CGA-wv7j-hqgx-r9jgCGA-ww83-654f-9c45CGA-x4r6-462v-9868CGA-x536-7654-4chcCGA-x55f-g322-4mgxCGA-x692-f8fp-6474CGA-x825-jmjm-h3xrCGA-xc27-v5ph-jf9cCGA-xgf2-853q-5wffCGA-xgf3-qm32-xc7gCGA-xgfw-hj72-qgwjCGA-xh2p-58hh-8jg8CGA-xr9m-7mm7-fgxqCGA-xvx2-h34m-ghmvCGA-xwf7-673j-mc2vCGA-g765-c5wg-ccg2CGA-w8f3-rm5x-r4j6
Advisory lineage Upstream: 0 Downstream: 10
Deferred
Published: 18 Jul 2025, 16:34
Last modified:03 Nov 2025, 20:07
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.4 CRITICAL
v4.0 (cve.org)
EPSS Score
1.77% LOW
2% probability +1.60%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
18 Jul 2025, 16:34
Published
Vulnerability first disclosed
03 Nov 2025, 20:07
Last Modified
Vulnerability information updated
Description
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVSS Metrics
- v4.0•CRITICAL•Score: 9.4CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- v4.0•CRITICAL•Score: 9.4CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Trends
Current EPSS score: 1.77%• Percentile: 77%
Techniques & Countermeasures
- CWE-330•Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Affected Systems
- chainguard•airflow-2
< 2.11.0-r15
- chainguard•arangodb-3.11
< 3.11.14.4-r8
- chainguard•gitlab-rails-ce-18.1
< 18.1.6-r18
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.11
< 18.11.6-r6
- chainguard•gitlab-rails-ce-18.5
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
< 19.0.3-r1
- chainguard•gitlab-rails-ce-19.1
< 19.1.1-r4
- chainguard•gitlab-rails-ce-fips-18.1
< 18.1.6-r86 | < 18.1.6-r15
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.11
< 18.11.6-r7
- chainguard•gitlab-rails-ce-fips-18.5
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
< 19.0.4-r2
- chainguard•gitlab-rails-ce-fips-19.1
< 19.1.1-r1
- chainguard•jitsucom-jitsu
< 2.10.0-r4
- chainguard•jitsucom-jitsu-console
< 2.10.0-r4
- chainguard•jitsucom-jitsu-rotor
< 2.10.0-r4
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kibana-7
< 7.17.29-r2
- chainguard•kibana-9
< 9.0.4-r0
- chainguard•kubeflow-centraldashboard
< 1.10.0-r10
- chainguard•kubeflow-pipelines-frontend
< 2.15.0-r1 | < 2.14.3-r3
- chainguard•opensearch-dashboards-2
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-alerting-dashboards-plugin
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-anomaly-detection-dashboards-plugin
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-config
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-maps
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-notifications
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-observability
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-query-workbench
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-reporting
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-search-relevance
< 2.19.2-r4
- chainguard•opensearch-dashboards-2-dashboards-visualizations
< 2.19.2-r4
Showing first 50 affected entries in server-rendered view.
References (9)
- https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4
- https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0
- https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-7783
- https://github.com/benweissmann/CVE-2025-7783-poc
- https://github.com/form-data/form-data
- https://security-tracker.debian.org/tracker/CVE-2025-7783
- https://npmjs.com/form-data
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7783.json