# CVE-2025-7783: Usage of unsafe random function in form-data for choosing boundary

- Exploited (CISA KEV): no
- Published: 2025-07-18
- CVSS: 9.4 CRITICAL (v4.0)
- EPSS: 1.8% (79th percentile)
- CWE: CWE-330

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.

This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-10-06 | 80 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-08-24 | 37 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-10-06 · new · rule 05eea4fabf6f4cf3aac1094b961f26a7 · default Block
  > Form-Data - Parameter Pollution - CVE:CVE-2025-7783. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-10-06-waf-release/

### F5

- 2025-08-24 · new · rule 200018195
  > Added: signature 200018195 "form_data.Js HTTP Parameter Pollution" (Other Application Attacks, risk High), systems: JavaScript. References: CVE-2025-7783.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-7783 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-7783