Usage of unsafe random function in form-data for choosing boundary
Priority HIGH 76CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 21 fixed, 32 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0181 78th percentileScored 2026-11-07
Fix Partial form-data: 2.5.4form-data (npm): 2.5.4, 3.0.4, 4.0.4Red Hat: 18 advisoriesRed Hat: 21 fixed, 32 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | form-data | before 2.5.4; 3.0.0 - 3.0.3; 4.0.0 - 4.0.3 | 2.5.4 | Patch available | CNA |
| — | form-data (npm) | before 2.5.4 | 2.5.4 | Patch available | GHSA-fjxv-7rqg-78g4 |
| — | form-data (npm) | 3.0.0 to before 3.0.4 | 3.0.4 | Patch available | GHSA-fjxv-7rqg-78g4 |
| — | form-data (npm) | 4.0.0 to before 4.0.4 | 4.0.4 | Patch available | GHSA-fjxv-7rqg-78g4 |
- form-data Vendor— Affected before 2.5.4; 3.0.0 - 3.0.3; 4.0.0 - 4.0.3 Fixed in 2.5.4 Patch available CNA
- form-data (npm) Vendor— Affected before 2.5.4 Fixed in 2.5.4 Patch available GHSA-fjxv-7rqg-78g4
- form-data (npm) Vendor— Affected 3.0.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-fjxv-7rqg-78g4
- form-data (npm) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-fjxv-7rqg-78g4
Remediation
- Fix · CNA form-data Fixed in 2.5.4
- Fix · GHSA-fjxv-7rqg-78g4 form-data (npm) Fixed in 2.5.4 Advisory →
- Fix · GHSA-fjxv-7rqg-78g4 form-data (npm) Fixed in 3.0.4 Advisory →
- Fix · GHSA-fjxv-7rqg-78g4 form-data (npm) Fixed in 4.0.4 Advisory →
Red Hat 18 advisories
- RHSA-2026:83548 Released 2026-10-15 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:59439 Released 2026-08-25 · Red Hat rating ImportantRHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +5
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
Show 15 more Red Hat advisories
- RHSA-2026:3406 Released 2026-02-26 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
- RHSA-2026:2800 Released 2026-02-17 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:2737 Released 2026-02-16 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2025:23529 Released 2025-12-17 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes 2.11.9 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/klusterlet-addon-controller-rhel9, registry.redhat.io/rhacm2/kube-rbac-proxy-rhel9 +3
- RHSA-2025:23528 Released 2025-12-17 · Red Hat rating Importantmulticluster engine for Kubernetes 2.6 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +6
- RHSA-2025:21704 Released 2025-11-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2025:21146 Released 2025-11-12 · Red Hat rating ImportantCluster Observability Operator 1.3.0
- Cluster Observability Operator 1.3.1 registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/korrel8r-rhel9
- RHSA-2025:20047 Released 2025-11-10 · Red Hat rating ModerateRed Hat Developer Hub 1.8.0 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2025:19335 Released 2025-10-30 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes 2.14.1 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +9
- RHSA-2025:19332 Released 2025-10-30 · Red Hat rating Importantmulticluster engine for Kubernetes 2.9.1 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9 +7
- RHSA-2025:17501 Released 2025-10-07 · Red Hat rating ImportantRHOAI 2.24.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.24 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator
- RHSA-2025:16918 Released 2025-09-29 · Red Hat rating ModerateRHACS 4.7.7 bug fix and security update
- Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
- RHSA-2025:15771 Released 2025-09-15 · Red Hat rating ModerateRHACS 4.8.4 security and bug fix update
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
- RHSA-2025:14919 Released 2025-09-03 · Red Hat rating ImportantRed Hat build of Cryostat 4.0.2: new RHEL 9 container image security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
- RHSA-2025:14886 Released 2025-08-28 · Red Hat rating ModerateKiali 2.4.8 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| OpenShift Service Mesh 3 | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Discovery 1 | Affected | No fix yet |
| Red Hat Edge Manager preview | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet |
| streams for Apache Kafka 2 | Affected | No fix planned: Will not fix |
| Cluster Observability Operator 1.3.1 | Fixed | RHSA-2025:21146 |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2025:14919 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2025:23529 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | Fixed | RHSA-2025:18744 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 | Fixed | RHSA-2025:16113 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2025:19335 |
| Red Hat Advanced Cluster Security 4.7 | Fixed | RHSA-2025:16918 |
| Red Hat Advanced Cluster Security 4.8 | Fixed | RHSA-2025:15771 |
| Red Hat Ceph Storage 7 | Fixed | RHSA-2026:2800 |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:83548 |
| Red Hat Ceph Storage 8 | Fixed | RHSA-2026:2737 |
| Red Hat Ceph Storage 9 | Fixed | RHSA-2026:3406 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2025:20047 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat OpenShift AI 2.24 | Fixed | RHSA-2025:17501 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2025:14886 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2025:21704 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:59439 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2025:23528 |
| multicluster engine for Kubernetes 2.7 for RHEL 9 | Fixed | RHSA-2025:18278 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2025:19332 |
Not affected: 36 products
- Cluster Observability Operator 1.3.1
- Cryostat 4
- Migration Toolkit for Applications 7
- Migration Toolkit for Virtualization
- Network Observability Operator
- Node HealthCheck Operator
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Security 4
- Red Hat Advanced Cluster Security 4.7
- Red Hat Advanced Cluster Security 4.8
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.8
- Red Hat Edge Manager preview
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.24
- Red Hat OpenShift GitOps
- Red Hat OpenShift distributed tracing 3
- Red Hat Openshift Data Foundation 4.20
- Red Hat Trusted Artifact Signer 1.3
- Red Hat build of Apache Camel - HawtIO 4
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7783
- 2026-10-03 Alias added: GHSA-fjxv-7rqg-78g4
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
- 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Advisory 2
Sources
- CVE-2025-7783 · CVE Program
- CVE-2025-7783 · NVD
- FIRST EPSS
- GHSA-fjxv-7rqg-78g4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-7783 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences