Skip to content
Fencer Vulns
high 7.5

CVE-2026-12143 json

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

published 2026-06-12 4 mo ago modified 2026-09-11 59 d ago also GHSA-hmw2-7cc7-3qxx , EUVD-2026-36524

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

Patch / fix

  • npm form-data 2.5.6, 3.0.5, 4.0.6
  • form-data form-data 2.5.6, 3.0.5, 4.0.6
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-13
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.13-1.el9ap
  • Red Hat Red Hat Enterprise Linux 10 0:1.1.2-1.el10_2
  • Red Hat Cluster Observability Operator 1.5.0 1782838476, 1782838753, 1782839193, 1782839279, 1782839494, 1782839658, 1782839981, 1782839996, 1782840519, 1782840539, 1782841925, 1782844225
  • Red Hat multicluster engine for Kubernetes 2.1 1787079364
  • Red Hat multicluster engine for Kubernetes 2.11 1787065052
  • Red Hat multicluster engine for Kubernetes 2.6 1787264250
  • Red Hat multicluster engine for Kubernetes 2.8 1787259048
  • Red Hat multicluster engine for Kubernetes 2.9 1787079359
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 1787687062
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1787339249
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1787339248
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1787341780
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1787339213
  • Red Hat Red Hat Advanced Cluster Security 4.9 1783357116
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1783357140
  • Red Hat Red Hat Ansible Automation Platform 2.1 1787047114
  • Red Hat Red Hat Ansible Automation Platform 2.2 1788943531
  • Red Hat Red Hat Ansible Automation Platform 2.6 1787219751
  • Red Hat Red Hat Ansible Automation Platform 2.7 1787218409
  • Red Hat Red Hat Developer Hub 1.10 1783448184
  • Red Hat Red Hat Developer Hub 1.9 1784210921
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat Migration Toolkit for Applications 8.1 1785169013
  • Red Hat Red Hat OpenShift AI 3.4 1786611759, 1787250508, 1787250617, 1787251250, 1787251550, 1787347991
  • Red Hat Red Hat OpenShift Container Platform 4.19 1788318661
  • Red Hat Red Hat OpenShift Container Platform 4.20 1784724699, 1787080892, 1787736396
  • Red Hat Red Hat OpenShift Container Platform 4.21 1784713741, 1787014197, 1787590390
  • node-form-data Debian 14 4.0.6+~2.1.0-1

debian advisories DEBIAN-CVE-2026-12143

  • python-django ansible automation platform developer 2.6, ansible automation platform 2.6 5.2.17-1.el10ap
  • python3-django ansible automation platform developer 2.6, ansible automation platform 2.6 5.2.17-1.el10ap
  • python3.12-django ansible automation platform developer 2.6, ansible automation platform 2.6 5.2.17-1.el9ap
  • python3.12-aiohttp ansible automation platform 2.6 3.14.3-1.el9ap
  • python3.12-gitpython ansible automation platform 2.6 3.1.59-1.el9ap
  • automation-platform-ui ansible automation platform 2.6 2.6.13-1.el9ap
  • automation-controller-cli ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.16-1.el9ap
  • automation-controller-venv-tower ansible automation platform 2.6 4.7.16-1.el9ap

red hat advisories RHSA-2026:59136RHSA-2026:57590

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1
  • agama-web-ui openSUSE Leap 16.0 17+673.b97ba64d6-160000.12.1

opensuse advisories openSUSE-SU-2026:12070-1openSUSE-SU-2026:21448-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12143 updated cvss 7.5

form-data: form-data: Form field override via CRLF injection

  • Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-pf4-rhel9, network-observability/network-observability-console-plugin-pf5-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 automation-hub, automation-gateway, python3x-galaxy-ng, python3.11-galaxy-ng
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 form-data Red Hat Build of Podman Desktop rh-podman-desktop.git
    affected: workaround, no fix available
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-rhel-rhel10, rhdesktop/rh-podman-desktop-ext-sandbox-rhel10, rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 8 cockpit-composer
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 form-data
    affected: workaround, no fix planned “Out of support scope”
show 27 more
  • Red Hat JBoss Enterprise Application Platform 7 form-data
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat Trusted Artifact Signer rhtas/rhtas-console-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/logging-console-plugin-rhel9 1782841925, cluster-observability-operator/monitoring-console-plugin-rhel9 1782838476, cluster-observability-operator/logging-console-plugin-pf4-rhel9 1782839279, cluster-observability-operator/logging-console-plugin-pf5-rhel9 1782840539, cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1782844225, cluster-observability-operator/monitoring-console-plugin-pf6-rhel9 1782839658, +6 more
    fixed: vendor fix RHSA-2026:34342
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-13
    fixed: vendor fix RHSA-2026:48151
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/console-mce-rhel9 1787264250
    fixed: vendor fix RHSA-2026:59579
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/console-mce-rhel9 1787259048
    fixed: vendor fix RHSA-2026:59558
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/console-mce-rhel9 1787079359
    fixed: vendor fix RHSA-2026:59559
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/console-mce-rhel9 1787079364
    fixed: vendor fix RHSA-2026:59557
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/console-mce-rhel9 1787065052
    fixed: vendor fix RHSA-2026:59556
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1787687062
    fixed: vendor fix RHSA-2026:60387
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1787339249
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1787339248
    fixed: vendor fix RHSA-2026:60388
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/console-rhel9 1787341780
    fixed: vendor fix RHSA-2026:60389
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/console-rhel9 1787339213
    fixed: vendor fix RHSA-2026:60391
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1783357116
    fixed: vendor fix RHSA-2026:36319
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1783357140
    fixed: vendor fix RHSA-2026:36625
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/bootc-automation-portal-rhel9 1788943531
    fixed: vendor fix RHSA-2026:66003
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1787219751
    fixed: vendor fix RHSA-2026:59155
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.13-1.el9ap
    fixed: vendor fix RHSA-2026:59136
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1787218409
    fixed: vendor fix RHSA-2026:59153
  • Red Hat Data Grid 8.6.2
    fixed: vendor fix RHSA-2026:41951
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1784210921
    fixed: vendor fix RHSA-2026:41929
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1783448184
    fixed: vendor fix RHSA-2026:36754

27 more fixed, 59 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm form-data
<2.5.6
>=3.0.0, <3.0.5
>=4.0.0, <4.0.6
2.5.6
3.0.5
4.0.6

Affected products

  • form-data form-data
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Ansible Automation Platform 2.1
  • Red Hat Red Hat Ansible Automation Platform 2.2
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat Developer Hub 1.10
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat Migration Toolkit for Applications 8.1
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Dev Spaces 3.29
  • Red Hat Red Hat OpenShift Dev Spaces 3.30
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Red Hat Satellite 6.19

Classification

Weakness
  • CWE-93 Improper Neutralization of CRLF Sequences

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.