Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
CVSS Details
- CVSS 4.0 Base Score: 9.4 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade node-form-data | Jul 21, 2025 | Jul 18, 2025 |
| Red Hat Jboss Eap | — | — | Jul 30, 2025 | Jul 18, 2025 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 18, 2025 |
| Suse | — | Upgrade nodejs18Upgrade nodejs18-docsUpgrade npm18Upgrade nodejs18-devel | Dec 5, 2025 | Nov 3, 2025 |
| Ubuntu | — | Upgrade node-form-data (Ubuntu Pro)Upgrade node-form-data | Jan 28, 2026 | Jan 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub