GHSA-HMW2-7CC7-3QXX form-data: CRLF injection in form-data via unescaped multipart field names and filenames

🗓️ 15 Jun 2026 17:26:26Reported by GoogleType

osv🔗 osv.dev👁 58 Views

CRLF injection in form-data field names and filenames enables header and multipart part injection; escape.

Reporter	Title	Published	Views	Family All 144
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	21 Aug 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)	24 Jul 202616:33	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename	7 Aug 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify	21 Jul 202605:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Aug 202610:39	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance	10 Aug 202612:25	–	ibm

Source	Link
github	www.github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-12143
github	www.github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
github	www.github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
github	www.github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
github	www.github.com/form-data/form-data
html	www.html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs	www.npmjs.com/package/form-data

17 Jun 2026 08:59Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

CVSS 48.7

EPSS0.00535