CRLF injection in form-data - CVE-2026-12143
Published: July 21, 2026
Vulnerability identifier: #VU138926
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-12143
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: FormData
Affected software:
form-data
form-data
Detailed vulnerability description
The vulnerability allows a remote attacker to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
How to mitigate CVE-2026-12143
Install updates from vendor's website.
Sources
- https://cwe.mitre.org/data/definitions/93.html
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
- https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
- https://www.npmjs.com/package/form-data
- https://access.redhat.com/errata/RHSA-2026:33155
- https://access.redhat.com/errata/RHSA-2026:33160
- https://access.redhat.com/errata/RHSA-2026:33163
- https://access.redhat.com/errata/RHSA-2026:33173
- https://access.redhat.com/errata/RHSA-2026:33183
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/security/cve/CVE-2026-12143
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json