PT-2026-48950 · Npm · Form-Data

Ljharb + 1 · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-12143

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions form-data versions prior to 2.5.6 form-data versions prior to 3.0.5 form-data versions prior to 4.0.6

Description The field argument to FormData#append and the filename option are concatenated verbatim into the Content-Disposition header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. This allows an attacker to perform CRLF injection (Carriage Return Line Feed injection), which is the process of inserting special characters to manipulate the structure of an HTTP header. If an application uses untrusted input as a field name or filename, an attacker can terminate the header line to inject additional headers or smuggle entire multipart parts into the request forwarded to a backend. This can enable the attacker to add or override form fields, such as setting is admin=true, as seen by the downstream parser.

Recommendations Update to version 2.5.6. Update to version 3.0.5. Update to version 4.0.6.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-12143

Affected Products

Form-Data

References · 9

• 🔥 https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx · Exploit
• https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 · Patch
• https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 · Patch
• https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-12143 · Security Note
• https://npmjs.com/package/form-data · Note
• https://cwe.mitre.org/data/definitions/93.html · Note
• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data · Note
• https://twitter.com/UpwindMDR/status/2065526738063425974 · Twitter Post