CVE-2026-12143

Description

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

References

https://www.npmjs.com/package/form-data

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json

https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data

https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx

https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045

https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229

https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435

https://cwe.mitre.org/data/definitions/93.html

https://bugzilla.redhat.com/show_bug.cgi?id=2488480

https://access.redhat.com/security/cve/CVE-2026-12143

https://access.redhat.com/errata/RHSA-2026:63355

https://access.redhat.com/errata/RHSA-2026:62260

https://access.redhat.com/errata/RHSA-2026:60520

https://access.redhat.com/errata/RHSA-2026:60477

https://access.redhat.com/errata/RHSA-2026:60446

https://access.redhat.com/errata/RHSA-2026:60391

https://access.redhat.com/errata/RHSA-2026:60390

https://access.redhat.com/errata/RHSA-2026:60389

https://access.redhat.com/errata/RHSA-2026:60388

https://access.redhat.com/errata/RHSA-2026:60387

https://access.redhat.com/errata/RHSA-2026:59579

https://access.redhat.com/errata/RHSA-2026:59559

https://access.redhat.com/errata/RHSA-2026:59558

https://access.redhat.com/errata/RHSA-2026:59557

https://access.redhat.com/errata/RHSA-2026:59556

https://access.redhat.com/errata/RHSA-2026:59155

https://access.redhat.com/errata/RHSA-2026:59153

https://access.redhat.com/errata/RHSA-2026:59136

https://access.redhat.com/errata/RHSA-2026:57801

https://access.redhat.com/errata/RHSA-2026:57590

https://access.redhat.com/errata/RHSA-2026:57545

https://access.redhat.com/errata/RHSA-2026:57013

https://access.redhat.com/errata/RHSA-2026:56431

https://access.redhat.com/errata/RHSA-2026:56366

https://access.redhat.com/errata/RHSA-2026:56338

https://access.redhat.com/errata/RHSA-2026:54770

https://access.redhat.com/errata/RHSA-2026:50300

https://access.redhat.com/errata/RHSA-2026:48693

https://access.redhat.com/errata/RHSA-2026:48151

https://access.redhat.com/errata/RHSA-2026:48124

https://access.redhat.com/errata/RHSA-2026:44267

https://access.redhat.com/errata/RHSA-2026:44263

https://access.redhat.com/errata/RHSA-2026:43052

https://access.redhat.com/errata/RHSA-2026:42796

https://access.redhat.com/errata/RHSA-2026:42146

https://access.redhat.com/errata/RHSA-2026:41951

https://access.redhat.com/errata/RHSA-2026:41929

https://access.redhat.com/errata/RHSA-2026:41928

https://access.redhat.com/errata/RHSA-2026:41066

https://access.redhat.com/errata/RHSA-2026:41031

https://access.redhat.com/errata/RHSA-2026:40262

https://access.redhat.com/errata/RHSA-2026:36754

https://access.redhat.com/errata/RHSA-2026:36625

https://access.redhat.com/errata/RHSA-2026:36319

https://access.redhat.com/errata/RHSA-2026:34342

https://access.redhat.com/errata/RHSA-2026:33183

https://access.redhat.com/errata/RHSA-2026:33173

https://access.redhat.com/errata/RHSA-2026:33163

https://access.redhat.com/errata/RHSA-2026:33160

https://access.redhat.com/errata/RHSA-2026:33155

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS