form-data: form-data: Form field override via CRLF injection

🗓️ 20 Jul 2026 11:56:31Reported by RedHatType

CRLF injection in form-data allows header or part smuggling via field or filename, risking data integrity.

Reporter	Title	Published	Views	Family All 618
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	21 Aug 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)	24 Jul 202616:33	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename	7 Aug 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	7 Sep 202622:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify	21 Jul 202605:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Aug 202610:39	–	ibm

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-12143
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cwe	www.cwe.mitre.org/data/definitions/93.html
github	www.github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
github	www.github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
github	www.github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
github	www.github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
html	www.html.spec.whatwg.org/multipage/form-control-infrastructure.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-12143
cve	www.cve.org/CVERecord

10 Sep 2026 23:39Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

CVSS 48.7

EPSS0.00535

SSVC