CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

[
  {
    "vendor": "form-data",
    "product": "form-data",
    "collectionURL": "https://www.npmjs.com/package/form-data",
    "packageName": "form-data",
    "repo": "https://github.com/form-data/form-data",
    "programFiles": [
      "lib/form_data.js"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.5.6",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.0.0",
        "lessThan": "3.0.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.0.0",
        "lessThan": "4.0.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]