{"id":"CVE-2026-12143","aliases":["GHSA-hmw2-7cc7-3qxx"],"url":"https://o3.security/vulnerability/CVE-2026-12143","summary":"form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)","details":"## Summary\n\n`form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\\r`), LF (`\\n`), or `\"`. An application that uses **untrusted input as a field name or filename** therefore lets an attacker terminate the header line and either inject additional headers or smuggle whole additional multipart parts into the request the application forwards to a backend.\n\nThis is CWE-93 (CRLF injection). It is a divergence from how browsers and the WHATWG HTML spec serialize form-data (they escape these characters), so the fix is to match that behavior. Severity is **conditional**: it depends on the consuming application passing attacker-controlled data as a field name or filename. Applications that only use fixed/trusted field names are not affected.\n\n## Details\n\nIn `lib/form_data.js`, `_multiPartHeader` builds the part header as:\n\n```javascript\n'Content-Disposition': ['form-data', 'name=\"' + field + '\"'].concat(contentDisposition || [])\n```\n\nand `_getContentDisposition` builds `filename=\"' + filename + '\"'`. Neither escapes control characters, so a `\\r\\n` in `field`/`filename` ends the header line. The same applies to `\"`, which can break out of the quoted parameter.\n\n### Proof of concept\n\n```javascript\nconst FormData = require('form-data');\nconst form = new FormData();\nform.append('email\"\\r\\nX-Injected: true\\r\\nfake=\"', 'user@example.com');\nconsole.log(form.getBuffer().toString());\n```\n\nBefore the fix this emits an injected `X-Injected: true` header line. A field name that also includes `--<boundary>` sequences can introduce additional parts (e.g. an extra `name=\"is_admin\"` field), which a downstream parser accepts as legitimate.\n\n## Impact\n\nFor an application that uses untrusted field names/filenames:\n\n- **Field injection / override (integrity).** Inject or override fields the backend trusts (e.g. `is_admin`, `role`) — the primary demonstrated impact.\n- **Header injection** into the generated multipart part.\n\nClaims of guaranteed privilege escalation, authentication bypass, high confidentiality impact, and availability impact are application-dependent downstream consequences, not properties of `form-data` itself, and are not demonstrated by the PoC.\n\n### Severity\n\nThe demonstrated, library-attributable impact is integrity (field/header injection); there is no demonstrated confidentiality disclosure or availability impact in `form-data` itself, and exploitation requires the consuming app to feed untrusted data into field names/filenames. A Moderate (≈5.3, `I:L`) rating is also defensible given that precondition.\n\n## Patch\n\nFixed in **4.0.6**, **3.0.5**, and **2.5.6**. Users on older 0.x/1.x/2.x releases should upgrade to 2.5.6 or later.\n\nThe fix escapes `\\r`, `\\n`, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the WHATWG HTML `multipart/form-data` encoding algorithm that browsers implement. This neutralizes the injection while leaving ordinary field names (including `name[0]`, dotted, and unicode names) unchanged.\n\n## Workaround\n\nUntil upgrading, validate or reject field names/filenames that contain control characters before calling `append`:\n\n```javascript\nif (/[\\r\\n]/.test(field)) { throw new Error('invalid field name'); }\n```\n\n## Credit\n\nReported by [yueyueL](https://github.com/yueyueL).","published":"2026-06-12T18:01:30.362Z","modified":"2026-09-13T03:30:20.429289234Z","cvss":null,"epss":{"score":0.00535,"percentile":0.42787,"asOf":"2026-08-25"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"form-data","fixedVersion":"2.5.6"},{"ecosystem":"npm","name":"form-data","fixedVersion":"3.0.5"},{"ecosystem":"npm","name":"form-data","fixedVersion":"4.0.6"}],"fix":{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","label":"form-data/form-data@64190db"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"},{"type":"WEB","url":"https://www.npmjs.com/package/form-data"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33155"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33160"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33163"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33173"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33183"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36319"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36625"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40262"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41031"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41929"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42146"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43052"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44263"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44267"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48124"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48693"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50300"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54770"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56366"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57013"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57590"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57801"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59136"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59153"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59155"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59556"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59557"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59558"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59559"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59579"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60446"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60477"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:63047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:63355"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:63373"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66003"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-12143"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12143.json"},{"type":"ADVISORY","url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480"},{"type":"FIX","url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"},{"type":"FIX","url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"},{"type":"FIX","url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"},{"type":"PACKAGE","url":"https://github.com/form-data/form-data"},{"type":"ARTICLE","url":"https://cwe.mitre.org/data/definitions/93.html"},{"type":"ARTICLE","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-13T03:30:20.429289234Z"}}