GHSA-hmw2-7cc7-3qxx
High · 7.5CVSS
7.5
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | form-data | 0 | 2.5.6 |
| npm | form-data | 3.0.0 | 3.0.5 |
Related vulnerabilities
- CVE-2026-12143 form-data is a library for creating readable multipart/form-data streams. Same vulnerability
- CVE-2025-7783 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter… Also affects form-data
- CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
- CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
- CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters… CWE-93
- CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
- CVE-2026-48019 Laravel is a web application framework. CWE-93