Ubuntu alert USN-7976-1 (node-form-data)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7976-1] Form-Data vulnerability
Date:
             
 
Tue, 27 Jan 2026 06:41:17 +0000
Message-ID:
             
 
<E1vkclJ-0003J1-Te@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7976-1
January 26, 2026

node-form-data vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Form-Data could be made to allow unintended access.

Software Description:
- node-form-data: A library to create readable 'multipart/form-data' streams

Details:

Ben Shonaldmann discovered that Form-data incorrectly generated boundary
values for multipart form-encoded data, leading to predictable values. A
remote attacker could possibly use this issue to make arbitrary requests
to internal systems.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  node-form-data                  4.0.0-1ubuntu0.1

Ubuntu 22.04 LTS
  node-form-data                  3.0.1-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  node-form-data                  3.0.0-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  node-form-data                  0.1.0-1ubuntu0.18.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  node-form-data                  0.1.0-1ubuntu0.16.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  node-form-data                  0.1.0-1ubuntu0.14.04.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7976-1
  CVE-2025-7783

Package Information:
  https://launchpad.net/ubuntu/+source/node-form-data/4.0.0...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAml4XVwACgkQcpJm3tlz
hgFz8A/8CziCJ7dlwcyLsxL7cgV7fGvFOWmV+IoZDqazMoqcDwS6pn4SQj3/TK/s
+Wy3wBoZOhsNdSxytMK317q+cVBr4Y+FrpaV028ZqVC+HaC+l9a0fmkejsy3ceYJ
ZAlHc4AfKwRfBScBU51p/7KoOXcZEPIPV9nlSJ8a2Sws9sZq2ckQQZxRTZ7qWCHO
pY6ZO7EKMu8xNiGuL63bFa78fu27USpHo+6Ub2d8iLnqLtpBxYtY6580AtQ3+T+0
qBPnsNnxRnJiRewqlBKvRlWYqKKm5hxn6xHHHk6/ckLTj21chr9wdZU4EHNjLse9
56YqUvTSo8fyJRxecbAjldnismoPKGEPZoNl9neiqpLrDtAnnn1Bk8Q34bb9DrMl
6T6Z85fBm+jjXxiNpYvk+Z9RwKyZuPeiMH0treV2kuc2sWmBbGcC5QkM2fz/sMrC
wn8Ed+/efT+y7gZl1JcgwBMhgQ/2o6f7BIrOPgDoNROH6uH+oC8sFqDO4K3Xlq6g
a4SSHry4b4ZDjRjW5LLWTF0fShWOIpsKRN0UafBtD6jsQHG1/6WmKu8z98pWwVsh
hovMYLAgMuJUzGXfRziF/i6lqcb2Y/9W3cszQkw9r3EKJzmJ9ZVugUSpb5LyODOt
JTcoEaGYTQ+OVyoCurxXGf4CxKDJcQbj6AxOYvPoPK+wg6Cy9bI=
=N/HY
-----END PGP SIGNATURE-----