form-data: form-data: Form field override via CRLF injection

🗓️ 10 Jul 2026 05:14:22Reported by RedHatType

Form-data library vulnerability allows carriage return and line feed injection in field or filename to smuggle headers or parts.

Reporter	Title	Published	Views	Family All 142
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)	24 Jul 202616:33	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename	7 Aug 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify	21 Jul 202605:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Aug 202610:39	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in form-data affects IBM Netezza Appliance	10 Aug 202612:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 Aug 202616:26	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	any	noarch	dotnet8	0-main@aarch64	[email protected]
Red Hat Enterprise Linux	any	noarch	dotnet8	0-main@x86_64	dotnet8-0-main@x86_64.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-12143
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cwe	www.cwe.mitre.org/data/definitions/93.html
github	www.github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
github	www.github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
github	www.github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
github	www.github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
html	www.html.spec.whatwg.org/multipage/form-control-infrastructure.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-12143
cve	www.cve.org/CVERecord

14 Jul 2026 15:02Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 48.7

EPSS0.00535

SSVC