Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12143— form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Quick assessment

Affected
form-data form-data
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FormData Form-Data是FormData团队开源的一个用于创建可读的表单数据流的模块。可用于向其他web应用程序提交表单和文件上传。 FormData Form-Data存在输入验证错误漏洞，该漏洞源于未对CR、LF和双引号字符转义导致CRLF注入，可能导致攻击者添加或覆盖表单字段。

CVSS 7.5 · High EPSS 0.67% · P51

Affected Version Matrix 3

VendorProduct Version RangeStatus
form-data form-data < 2.5.6 affected
3.0.0< 3.0.5 affected
4.0.0< 4.0.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12143

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Source: CVE Program / CVE List V5
Vulnerability Description
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Vulnerability Title
FormData Form-Data 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FormData Form-Data是FormData团队开源的一个用于创建可读的表单数据流的模块。可用于向其他web应用程序提交表单和文件上传。 FormData Form-Data存在输入验证错误漏洞，该漏洞源于未对CR、LF和双引号字符转义导致CRLF注入，可能导致攻击者添加或覆盖表单字段。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
form-data form-data 0 ~ 2.5.6 -

II. Public POCs for CVE-2026-12143

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 8110 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-12143

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12143 (3)

Vendor Advisories for CVE-2026-12143 (1)

Vendor Pages for CVE-2026-12143 (1)

Other References for CVE-2026-12143 (1)

IV. Related Vulnerabilities

Same weakness: CWE-93

V. Comments for CVE-2026-12143

No comments yet

Leave a comment