{"id":"CVE-2026-12143","title":"form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)","summary":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-93"],"vendor":"form-data","product":"form-data","affected":["form-data < 2.5.6","form-data >= 3.0.0 < 3.0.5","form-data >= 4.0.0 < 4.0.6"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-12T19:04:40.604029Z"},"exploitAvailable":true,"published":"2026-06-12","updated":"2026-09-11","sourceUpdated":"2026-09-11T12:08:59.965Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-12143","references":[{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","label":"GHSA-hmw2-7cc7-3qxx"},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","label":"Fix commit (4.0.6)"},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","label":"Fix commit (3.0.5)"},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","label":"Fix commit (2.5.6)"},{"url":"https://www.npmjs.com/package/form-data","label":"npm: form-data"},{"url":"https://cwe.mitre.org/data/definitions/93.html","label":"CWE-93"},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","label":"WHATWG HTML: multipart/form-data encoding algorithm"},{"url":"https://access.redhat.com/errata/RHSA-2026:33155","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33163","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33173","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41929","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44263","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44267","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48124","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48693","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54770","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56366","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:56431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57013","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57801","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59136","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59153","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59155","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59556","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59557","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59558","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59559","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59579","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60446","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60477","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63047","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63355","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63373","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66003","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143"},{"url":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx"}],"tags":["cve.org","exploit-available","nvd","ghsa","npm"],"epss":0.00669,"epssPercentile":0.49849,"aliases":["GHSA-hmw2-7cc7-3qxx"],"ecosystem":"npm","patched":["form-data 2.5.6","form-data 3.0.5","form-data 4.0.6"],"ingestedAt":"2026-07-07T15:41:58.885Z","slug":"CVE-2026-12143","body":"## Overview\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.\n\n## Affected\n\n- `form-data < 2.5.6`\n- `form-data >= 3.0.0 < 3.0.5`\n- `form-data >= 4.0.0 < 4.0.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-12143)\n\nAffected packages:\n\n- `form-data < 2.5.6`\n- `form-data >= 3.0.0, < 3.0.5`\n- `form-data >= 4.0.0, < 4.0.6`\n\nPatched in:\n\n- `form-data 2.5.6`\n- `form-data 3.0.5`\n- `form-data 4.0.6`\n\nSource: https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201458,"id":"CVE-2026-12143","ts":1789399467281,"field":"exploit_available","old":"false","new":"true"},{"seq":200192,"id":"CVE-2026-12143","ts":1789396929565,"field":"exploit_available","old":"true","new":"false"},{"seq":198115,"id":"CVE-2026-12143","ts":1789387977976,"field":"exploit_available","old":"false","new":"true"},{"seq":195909,"id":"CVE-2026-12143","ts":1789383306319,"field":"exploit_available","old":"true","new":"false"},{"seq":194838,"id":"CVE-2026-12143","ts":1789380274466,"field":"exploit_available","old":"false","new":"true"},{"seq":193625,"id":"CVE-2026-12143","ts":1789378168191,"field":"exploit_available","old":"true","new":"false"},{"seq":192412,"id":"CVE-2026-12143","ts":1789376195015,"field":"exploit_available","old":"false","new":"true"},{"seq":191199,"id":"CVE-2026-12143","ts":1789373039954,"field":"exploit_available","old":"true","new":"false"},{"seq":189984,"id":"CVE-2026-12143","ts":1789369097182,"field":"exploit_available","old":"false","new":"true"},{"seq":188771,"id":"CVE-2026-12143","ts":1789367990619,"field":"exploit_available","old":"true","new":"false"},{"seq":187554,"id":"CVE-2026-12143","ts":1789364952056,"field":"exploit_available","old":"false","new":"true"},{"seq":186341,"id":"CVE-2026-12143","ts":1789362907876,"field":"exploit_available","old":"true","new":"false"},{"seq":185127,"id":"CVE-2026-12143","ts":1789360937162,"field":"exploit_available","old":"false","new":"true"},{"seq":183914,"id":"CVE-2026-12143","ts":1789357852200,"field":"exploit_available","old":"true","new":"false"},{"seq":182166,"id":"CVE-2026-12143","ts":1789354062111,"field":"exploit_available","old":"false","new":"true"},{"seq":180959,"id":"CVE-2026-12143","ts":1789352879729,"field":"exploit_available","old":"true","new":"false"},{"seq":179752,"id":"CVE-2026-12143","ts":1789349955506,"field":"exploit_available","old":"false","new":"true"},{"seq":178545,"id":"CVE-2026-12143","ts":1789347714860,"field":"exploit_available","old":"true","new":"false"},{"seq":177338,"id":"CVE-2026-12143","ts":1789346143495,"field":"exploit_available","old":"false","new":"true"},{"seq":176131,"id":"CVE-2026-12143","ts":1789342649562,"field":"exploit_available","old":"true","new":"false"},{"seq":175917,"id":"CVE-2026-12143","ts":1789342263105,"field":"exploit_available","old":"false","new":"true"},{"seq":175455,"id":"CVE-2026-12143","ts":1789338287535,"field":"exploit_available","old":"true","new":"false"},{"seq":174250,"id":"CVE-2026-12143","ts":1789334562674,"field":"exploit_available","old":"false","new":"true"},{"seq":173045,"id":"CVE-2026-12143","ts":1789333142986,"field":"exploit_available","old":"true","new":"false"},{"seq":171859,"id":"CVE-2026-12143","ts":1789330839171,"field":"exploit_available","old":"false","new":"true"},{"seq":170673,"id":"CVE-2026-12143","ts":1789328295328,"field":"exploit_available","old":"true","new":"false"},{"seq":169468,"id":"CVE-2026-12143","ts":1789326860328,"field":"exploit_available","old":"false","new":"true"},{"seq":168263,"id":"CVE-2026-12143","ts":1789323321228,"field":"exploit_available","old":"true","new":"false"},{"seq":167058,"id":"CVE-2026-12143","ts":1789319335195,"field":"exploit_available","old":"false","new":"true"},{"seq":165853,"id":"CVE-2026-12143","ts":1789318174353,"field":"exploit_available","old":"true","new":"false"},{"seq":164648,"id":"CVE-2026-12143","ts":1789315504256,"field":"exploit_available","old":"false","new":"true"},{"seq":163443,"id":"CVE-2026-12143","ts":1789313188192,"field":"exploit_available","old":"true","new":"false"},{"seq":162238,"id":"CVE-2026-12143","ts":1789311684526,"field":"exploit_available","old":"false","new":"true"},{"seq":161033,"id":"CVE-2026-12143","ts":1789308186169,"field":"exploit_available","old":"true","new":"false"},{"seq":160538,"id":"CVE-2026-12143","ts":1789304120925,"field":"exploit_available","old":"false","new":"true"},{"seq":158376,"id":"CVE-2026-12143","ts":1789299191896,"field":"exploit_available","old":"true","new":"false"},{"seq":157340,"id":"CVE-2026-12143","ts":1789296434439,"field":"exploit_available","old":"false","new":"true"},{"seq":156135,"id":"CVE-2026-12143","ts":1789294305437,"field":"exploit_available","old":"true","new":"false"},{"seq":154930,"id":"CVE-2026-12143","ts":1789292602042,"field":"exploit_available","old":"false","new":"true"},{"seq":153725,"id":"CVE-2026-12143","ts":1789289259151,"field":"exploit_available","old":"true","new":"false"},{"seq":152937,"id":"CVE-2026-12143","ts":1789285155796,"field":"exploit_available","old":"false","new":"true"},{"seq":152181,"id":"CVE-2026-12143","ts":1789280886254,"field":"exploit_available","old":"true","new":"false"},{"seq":151142,"id":"CVE-2026-12143","ts":1789277387809,"field":"exploit_available","old":"false","new":"true"},{"seq":150109,"id":"CVE-2026-12143","ts":1789275850451,"field":"exploit_available","old":"true","new":"false"},{"seq":149076,"id":"CVE-2026-12143","ts":1789273581438,"field":"exploit_available","old":"false","new":"true"},{"seq":147871,"id":"CVE-2026-12143","ts":1789270798295,"field":"exploit_available","old":"true","new":"false"},{"seq":145911,"id":"CVE-2026-12143","ts":1789269148444,"field":"exploit_available","old":"false","new":"true"},{"seq":144815,"id":"CVE-2026-12143","ts":1789266049619,"field":"exploit_available","old":"true","new":"false"},{"seq":143719,"id":"CVE-2026-12143","ts":1789262413184,"field":"exploit_available","old":"false","new":"true"},{"seq":142555,"id":"CVE-2026-12143","ts":1789261127517,"field":"exploit_available","old":"true","new":"false"}]}