# CVE-2026-12143: form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

> CVE-2026-12143: form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection). CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-12143
Last updated: 2026-09-11T13:17:04Z

- Published: 2026-06-12 18:01 UTC · Updated: 2026-09-11 13:17 UTC · Assigner: harborist
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS: 0.67%, 52th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-93

## Description

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the \`field\` argument to \`FormData\#append\` and the \`filename\` option are concatenated verbatim into the \`Content-Disposition\` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set \`is\_admin=true\`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and \`"\` as \`%0D\`, \`%0A\`, and \`%22\` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

## Affected vendors and products

- Red Hat: Cryostat 4
- Red Hat: Migration Toolkit for Applications 8
- Red Hat: Network Observability Operator
- Red Hat: OpenShift Pipelines
- Red Hat: OpenShift Service Mesh 3
- Red Hat: Red Hat 3scale API Management Platform 2
- Red Hat: Red Hat AMQ Broker 7.13.6
- Red Hat: Red Hat AMQ Broker 7.14.1
- Red Hat: Red Hat Ansible Automation Platform 2
- Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat: Red Hat build of Apache Camel for Spring Boot 4
- Red Hat: Red Hat build of Apache Camel - HawtIO 4
- Red Hat: Red Hat build of Apicurio Registry 3
- Red Hat: Red Hat Build of Podman Desktop
- Red Hat: Red Hat Build of Podman Desktop - Tech Preview
- Red Hat: Red Hat Data Grid 8.6.2
- Red Hat: Red Hat Discovery 2
- Red Hat: Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat: Red Hat Fuse 7
- Red Hat: Red Hat Hardened Images
- Red Hat: Red Hat JBoss Enterprise Application Platform 7
- Red Hat: Red Hat JBoss Enterprise Application Platform 8
- Red Hat: Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat: Red Hat OpenShift AI (RHOAI)
- Red Hat: Red Hat OpenShift Container Platform 4
- Red Hat: Red Hat OpenShift GitOps
- Red Hat: Red Hat OpenShift Virtualization 4
- Red Hat: Red Hat Satellite 6

## Tracked companies

- [Bitbucket](https://rewindex.com/company/bitbucket.md)
- [Confluence](https://rewindex.com/company/confluence.md)
- [Jira](https://rewindex.com/company/jira.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-12143)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-12143)
- [https://cwe.mitre.org/data/definitions/93.html](https://cwe.mitre.org/data/definitions/93.html)
- [https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435](https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435)
- [https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229](https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229)
- [https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045](https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045)
- [https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx](https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx)
- [https://html.spec.whatwg.org/multipage/form-control-infrastructure.html\#multipart-form-data](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data)
- [https://www.npmjs.com/package/form-data](https://www.npmjs.com/package/form-data)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-12143 · Markdown: https://rewindex.com/cve/CVE-2026-12143.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-12143 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:43.254Z