CVE-2025-7783

Publication date 18 July 2025

Last updated 28 January 2026

Ubuntu priority

Description

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
node-form-data	25.10 questing	Not affected
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Fixed 4.0.0-1ubuntu0.1
	22.04 LTS jammy	Fixed 3.0.1-1ubuntu0.1~esm1
	20.04 LTS focal	Fixed 3.0.0-2ubuntu0.1~esm1
	18.04 LTS bionic	Fixed 0.1.0-1ubuntu0.18.04.1~esm1
	16.04 LTS xenial	Fixed 0.1.0-1ubuntu0.16.04.1~esm1
	14.04 LTS trusty	Fixed 0.1.0-1ubuntu0.14.04.1~esm1

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
node-form-data	Upstream: 3d17230

References

Related Ubuntu Security Notices (USN)

USN-7976-1
Form-Data vulnerability
26 January 2026