form-data: form-data: Form field override via CRLF injection

🗓️ 24 Aug 2026 16:39:47Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

CRLF injection in form-data allows header injection and form field override via crafted input.

Reporter	Title	Published	Views	Family All 632
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	21 Aug 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)	24 Jul 202616:33	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	15 Sep 202615:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in form-data-3.0.4.tgz	15 Sep 202620:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript	13 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename	7 Aug 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	7 Sep 202622:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	noarch	automation-platform-ui	2.6.13-1.el9ap	automation-platform-ui-2.6.13-1.el9ap.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-12143
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cwe	www.cwe.mitre.org/data/definitions/93.html
github	www.github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
github	www.github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
github	www.github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
github	www.github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
html	www.html.spec.whatwg.org/multipage/form-control-infrastructure.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-12143
cve	www.cve.org/CVERecord

21 Sep 2026 11:27Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00535

SSVC

form-data CRLF injection header injection multipart smuggling field override data integrity