THREAT OPS › Threat News › [NVD] CVE-2026-12143 (HIGH 7.5) — form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee
[NVD] CVE-2026-12143 (HIGH 7.5) — form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee
CVE-2026-12143 CVSS: 7.5 HIGH Published: 2026-06-12T19:16:26.560
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application
MITRE ATT&CK techniques
- Data EncodingT1132
Indicators of compromise
- CVE-2026-12143cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12143