Skip to main content

form-data EUVDEUVD-2026-36524

| CVE-2026-12143 HIGH
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-06-12 harborist GHSA-hmw2-7cc7-3qxx
Code Injection Form Data
8.7
CVSS 4.0 · Vendor: harborist
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify proxy/gateway using form-data
  2. Delivery
    Craft input with CRLF in field name
  3. Exploit
    Submit to upstream API endpoint
  4. Execution
    Library emits malformed Content-Disposition
  5. Persist
    Backend parses smuggled multipart part
  6. Impact
    Override privileged field (is_admin=true)

Vulnerability Assessment

Weakness
CWE
CWE-93
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
Exploitation Conditions

The consuming application must pass attacker-controlled input as the field argument to FormData#append or as the filename option - typically seen in API gateways, proxies, or upload services that translate JSON object keys or user-supplied metadata into multipart field/file names before forwarding to a backend. A downstream multipart parser must accept the smuggled part (true for nearly all standards-compliant parsers). Exploitation is LIMITED to: (a) applications that do not use only fixed/trusted field names - the description explicitly excludes apps with hardcoded field names; (b) form-data versions ≤ 4.0.5, ≤ 3.0.4, or ≤ 2.5.5; and (c) deployments where the multipart body produced by form-data is actually forwarded somewhere that parses it (rather than terminated locally).
Impact

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VI:H but VC:N/VA:N correctly reflects an integrity-only impact reachable over the network without authentication or user interaction - consistent with a header-injection bug that lets attackers tamper with downstream form data but not directly read secrets or crash the service. Real-world risk is highly dependent on the consuming application: only deployments that pass untrusted input (e.g., JSON keys from API consumers translated into multipart field names, as in API gateway or proxy patterns) are exploitable, which the description explicitly states. There is no KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so this should be treated as a supply-chain hygiene priority rather than an active-incident response - but because form-data is a transitive dependency in vast swaths of the Node ecosystem, patch propagation matters and the CVSS 4.0 score of 8.7 is justified for affected gateway/proxy use cases.
Exploit ScenarioDerived

An attacker submits a JSON request to an API gateway that forwards JSON object keys as multipart field names to a backend service (e.g., a file-upload proxy). By supplying a key like username\r\nContent-Disposition: form-data; name="is_admin"\r\n\r\ntrue\r\n--boundary, the attacker smuggles a new multipart part into the upstream request, causing the backend parser to see an additional is_admin=true field and granting privilege escalation. No public exploit identified at time of analysis, but the technique is straightforward and the network/low-complexity/no-auth vector means weaponization is trivial once a vulnerable proxy is identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 12, 2026

CRLF injection in the form-data Node.js library (versions through 4.0.5) allows remote attackers to inject arbitrary multipart headers or smuggle additional form parts by supplying attacker-controlled field names or filenames containing CR, LF, or double-quote characters. The library concatenates these values verbatim into the Content-Disposition header without escaping, enabling parameter tampering (e.g., overriding is_admin=true) against downstream multipart parsers. No public exploit identified at time of analysis, though the vulnerability is patched in 2.5.6, 3.0.5, and 4.0.6.

RemediationAI

Vendor-released patches are available: upgrade form-data to 4.0.6 (4.x line), 3.0.5 (3.x line), or 2.5.6 (2.x line), per the advisory at https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx and commits 64190db, be3f3cf, and c7133499 on GitHub. Because form-data is frequently a transitive dependency, run npm ls form-data (or equivalent for yarn/pnpm) to identify indirect consumers and use overrides/resolutions to force the patched version. As a compensating control until upgrade, audit application code to ensure field names and filenames passed to FormData#append are never derived from untrusted input - restrict them to a fixed allowlist of trusted strings, or pre-validate/strip CR (\r), LF (\n), and double-quote (") characters before invocation; the trade-off is that this requires identifying every call site, and missed call sites remain exploitable.

Affected VersionsENISA

form-data 3.0.0 <3.0.5
form-data 4.0.0 <4.0.6
form-data 0 <2.5.6

Affected Packages

npm form-data fix: 2.5.6, 3.0.5, 4.0.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

form-data is a widely used Node.js library (npm: form-data) for constructing readable multipart/form-data streams, commonly used by HTTP clients like request, axios, and node-fetch wrappers when forwarding multipart bodies. The flaw is a CWE-93 (CRLF Injection) issue: the FormData#append method's field argument and the filename option are inserted directly into the Content-Disposition header line without sanitizing the CR (\r), LF (\n), or double-quote (") characters that delimit MIME headers and quoted parameter values. The WHATWG HTML specification's multipart/form-data encoding algorithm mandates that browsers escape these characters as %0D, %0A, and %22 respectively - the fix aligns the library's serialization with this browser-side behavior. The affected CPE is cpe:2.3:a:form-data:form-data:*:*:*:*:*:*:*:*.

Know when Form Data gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (harborist) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
vuln.today AI 8.6 HIGH

Network-reachable header injection with no auth or UI; scope changes because form-data corrupts a downstream parser's view of the request, with integrity-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (harborist).

CVSS VectorVendor: harborist

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormData#append and the filename option are concatenated verbatim into the Content-Disposition header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set is_admin=true) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and " as %0D, %0A, and %22 in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,047 npm packages depend on form-data (163 direct, 888 indirect)

Ecosystem-wide dependent count for version 3.0.0.

Executive ViewAI

Why It Matters

The form-data Node.js library (versions through 4.0.5) contains a CRLF injection vulnerability enabling remote attackers to manipulate multipart form headers and inject unauthorized parameters, potentially allowing privilege escalation through parameter tampering attacks. Applications using affected versions in authentication workflows or sensitive form processing face direct risk of unauthorized access and authorization bypass. Patched versions are available and must be deployed immediately.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 84% exploitable
Threat Intel
1
1 sources
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2026-84372 CRITICAL POC
9.8
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-116232 HIGH POC
8.6
CVE-2026-116231 HIGH POC
8.6
CVE-2026-54511 HIGH POC
8.6
CVE-2026-116237 HIGH POC
8.5

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435 PATCH https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229 PATCH https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045 ADVISORY https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-12143 ADVISORY https://vuldb.com/vuln/370702 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:34342 REF https://access.redhat.com/errata/RHSA-2026:36319 REF https://access.redhat.com/errata/RHSA-2026:36625 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:37577 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41929 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:44263 REF https://access.redhat.com/errata/RHSA-2026:44267 REF https://access.redhat.com/errata/RHSA-2026:48124 REF https://access.redhat.com/errata/RHSA-2026:48151 REF https://access.redhat.com/errata/RHSA-2026:48693 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:54770 REF https://access.redhat.com/errata/RHSA-2026:56338 REF https://access.redhat.com/errata/RHSA-2026:56366 REF https://access.redhat.com/errata/RHSA-2026:56431 REF https://access.redhat.com/errata/RHSA-2026:57013 REF https://access.redhat.com/errata/RHSA-2026:57545 REF https://access.redhat.com/errata/RHSA-2026:57590 REF https://access.redhat.com/errata/RHSA-2026:57801 REF https://access.redhat.com/errata/RHSA-2026:59136 REF https://access.redhat.com/errata/RHSA-2026:59153 REF https://access.redhat.com/errata/RHSA-2026:59155 REF https://access.redhat.com/errata/RHSA-2026:59556 REF https://access.redhat.com/errata/RHSA-2026:59557 REF https://access.redhat.com/errata/RHSA-2026:59558 REF https://access.redhat.com/errata/RHSA-2026:59559 REF https://access.redhat.com/errata/RHSA-2026:59579 REF https://access.redhat.com/errata/RHSA-2026:60387 REF https://access.redhat.com/errata/RHSA-2026:60388 REF https://access.redhat.com/errata/RHSA-2026:60389 REF https://access.redhat.com/errata/RHSA-2026:60390 REF https://access.redhat.com/errata/RHSA-2026:60391 REF https://access.redhat.com/errata/RHSA-2026:60446 REF https://access.redhat.com/errata/RHSA-2026:60477 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:62260 REF https://access.redhat.com/errata/RHSA-2026:63047 REF https://access.redhat.com/errata/RHSA-2026:63355 REF https://access.redhat.com/errata/RHSA-2026:63373 REF https://access.redhat.com/errata/RHSA-2026:66003 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-12143 REF https://bugzilla.redhat.com/show_bug.cgi?id=2488480 REF https://cwe.mitre.org/data/definitions/93.html REF https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json REF https://www.npmjs.com/package/form-data

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy