CRLF Injection in form-data via unescaped multipart field names (CVE-2026-12143)
Security AdvisoryCVE-2026-12143Highform-data
Affected:
- form-data < 2.5.6
- form-data >= 3.0.0, < 3.0.5
- form-data >= 4.0.0, < 4.0.6
Fixed in:
- 2.5.6
- 3.0.5
- 4.0.6
Referenced CVEs: CVE-2026-12143 · 7.5
文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive
This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.