CVE-2026-12143
Aliases:GHSA-hmw2-7cc7-3qxxDEBIAN-CVE-2026-12143CGA-2258-9228-63m6CGA-23q6-cjc3-mxf3CGA-2c2h-g966-63hrCGA-2cmf-8498-5pppCGA-2jjq-8976-c2vhCGA-33w5-g6v5-7crxCGA-3h3q-5cxh-j5xcCGA-3p3q-c6x2-8rg2CGA-3rx6-r553-wwwhCGA-3w4m-2vvj-hmx8CGA-3x4r-w9c4-wm2rCGA-43hc-f3hp-4975CGA-4c89-7767-vxqhCGA-4j5m-27vc-gqrvCGA-4xwq-572h-v829CGA-52q5-ch6g-3fv9CGA-5fxj-w5h3-p7vhCGA-5g38-c4m5-m72xCGA-5gx4-5rr8-qqw4CGA-5j38-2m47-377xCGA-5m2r-7fhj-2gx3CGA-5mmv-gr5v-9grjCGA-5q84-2pcp-mg29CGA-5rgc-8g5x-vg4gCGA-5v7w-qjgw-fqx4CGA-5w5x-m9h2-jq95CGA-5wm6-589g-6m6fCGA-5wq4-8xmc-xhjqCGA-5xvh-pw4h-w262CGA-676r-v6xq-fh9fCGA-6fwr-vvxh-9rfgCGA-6g39-gf7x-jh2cCGA-6h95-f54v-4qg7CGA-6j54-fmjq-c8qgCGA-6w94-3rwm-vx3cCGA-6x4c-j27x-8gcpCGA-72gj-cv27-qvvpCGA-72h2-cpgf-vv8fCGA-733c-9m43-9qfgCGA-73g2-mwpf-xx3hCGA-73pg-45fp-2v3qCGA-7456-m24r-23r3CGA-7f5p-57vh-658cCGA-7gmf-7wmg-w657CGA-7wp5-xj8p-9qxvCGA-8343-2fc5-6hrcCGA-83wh-x78x-q2mrCGA-845w-p32c-j6ggCGA-84cf-97x7-xg3wCGA-8662-mx75-c5vxCGA-87qx-c9mh-2mwgCGA-894g-6j22-7fwxCGA-8993-xvm9-frx8CGA-8cxh-jfgm-cv3gCGA-8m4q-j492-mx5qCGA-92c8-pvpr-m7crCGA-94jj-4mmq-6qv3CGA-97rv-vpg8-xfj9CGA-9868-pq4j-7xxwCGA-c699-4m64-8qmhCGA-chfp-rr9x-crc2CGA-cwq3-qv8q-78vhCGA-f4jw-8frx-899vCGA-f5c2-hpcg-hmjxCGA-f98m-7xpj-8f95CGA-f9qj-2pv6-hjqcCGA-fcfj-985g-5r6pCGA-ff3x-3jr3-5c72CGA-fj2j-pwhm-6cw7CGA-fm9x-jh4r-h4gvCGA-fwmr-x786-rhh6CGA-fx65-pmfv-m6m6CGA-g5h7-9p7h-jjr8CGA-gggw-9wqr-48m8CGA-ghvv-gjqf-87x7CGA-gqqv-22p9-3xgxCGA-grf9-698g-347pCGA-h5ph-7xj2-qxppCGA-h8h2-j9m3-qrjrCGA-hf75-3q73-rrqrCGA-hj69-rrm8-3qr2CGA-hqjf-rx32-gw96CGA-hqw4-4988-pf77CGA-hw8r-wq9m-3x4mCGA-j2fr-j5r8-3vwpCGA-j44r-p863-5q92CGA-j5g4-x94c-84x6CGA-j62q-rw7r-6w7mCGA-j8c5-mxpv-j284CGA-m56c-g3j2-vg9rCGA-m9w4-cxc4-2qchCGA-mcch-34cw-grgmCGA-mcgj-phvg-24w8CGA-mp7f-9m6r-98grCGA-mrjc-gxqr-vjmxCGA-mv8w-rm4p-5rxxCGA-p333-xpm2-m8mgCGA-p4w3-qcpr-3pxpCGA-p8rj-vgfp-32h8CGA-pc66-g4cr-5vh3CGA-pj2p-48p4-x7rpCGA-pjxp-g49f-jcc8CGA-pmgr-g92j-59x5CGA-pp5p-jvc7-r2qrCGA-pq44-wm32-vrjjCGA-pwjf-mv45-2gpwCGA-22g4-wq97-2p22CGA-2423-gc76-7rm2CGA-24rf-9v4r-54ghCGA-24xh-r288-6f7hCGA-25fq-7mwx-hf28CGA-25m2-35q8-782qCGA-28r6-p2jj-rwq9CGA-2c3m-vp47-h36xCGA-2f29-8m83-vp9wCGA-2f57-rfp6-pm6jCGA-2j8f-4pfw-vrhcCGA-2jg3-6f44-m7v6CGA-2m22-9grx-5x5mCGA-2m92-7gx6-ggpfCGA-2p9w-6p23-4c84CGA-2r4h-hrwh-wmw6CGA-2vwx-2r22-xvmpCGA-2wh3-cwx9-v8w9CGA-33jm-hjv5-xj9gCGA-3577-j3fq-fcqpCGA-388h-wp92-hq7jCGA-38px-g45w-v4qhCGA-3ggm-qhrj-9rv2CGA-3hjw-v96h-hgp3CGA-3jg7-3m33-6843CGA-3jpj-x929-7r2pCGA-3phh-vcg8-69rfCGA-3pjg-p9cm-q8f7CGA-3v7w-6864-3ppcCGA-3w9r-wp96-9cc8CGA-3xmf-hgj8-jxx7CGA-3xpm-p2c3-gqx2CGA-42m9-f8hx-qj2mCGA-48j3-j887-c2j4CGA-49r7-2p3v-x4w8CGA-4cqc-gwm7-8g6hCGA-4fhc-pwgp-5f7jCGA-4g2c-qqmx-v3qrCGA-4gf5-h69w-c49wCGA-4jwg-m84x-qrp4CGA-4mhg-r5qm-g5rxCGA-52f4-8w6p-w6g9CGA-52q7-4ww3-mhhfCGA-52vc-mp9r-vf9jCGA-5385-889h-4x7rCGA-53c6-vc3r-7pghCGA-53hh-fv4c-3f66CGA-55m8-8pxq-jvgwCGA-5663-rv34-83mwCGA-572q-phhh-6rw3CGA-58xm-pcqh-8j7rCGA-5jmv-hmq4-fp29CGA-5pw6-m4g4-x8fcCGA-5qvx-p434-g3wmCGA-5rcc-m7w8-3gc5CGA-5rq5-cj56-42vqCGA-5v3j-xxc7-rpj7CGA-5w64-h55j-mqw7CGA-5wxg-85qx-5rv9CGA-622w-94q9-pqpjCGA-639w-6qhg-crmqCGA-63hp-f9r9-g54gCGA-6483-88qq-3v6xCGA-696m-vjgx-5fc6CGA-6c99-2j5w-pm34CGA-6f2c-9x9j-4564CGA-6j6c-cwqm-8rr2CGA-6jjm-jjq6-vqjhCGA-6mhg-684h-mvv7CGA-6mvf-fc7h-q779CGA-6q36-w35f-h8jjCGA-6qw8-w425-w8jjCGA-73gh-vpjj-v6crCGA-7765-cgf3-9w8hCGA-77gx-r74r-p9pxCGA-794j-m32j-5998CGA-7c96-rgh2-6xc3CGA-7cj3-8h2c-hcfgCGA-7fff-j58x-v688CGA-7g44-wmf5-ggc6CGA-7gw7-pgf9-2xvvCGA-7j96-9r3h-wqp5CGA-7p8h-xhxr-5gg4CGA-7pv5-g4x4-h7cgCGA-7qg2-5ffq-crvqCGA-7qrg-rmr2-rf38CGA-7r7v-wwm7-5j2hCGA-7rmg-3r37-49pqCGA-7wvg-r2x7-g63jCGA-82w2-mhrw-q8cfCGA-832g-j2mf-4w38CGA-83xh-xgjh-v6fvCGA-84c3-3qw4-j855CGA-84f4-f397-8h9hCGA-875h-cw8g-7833CGA-878q-gw8w-235wCGA-88qf-xfjx-4874CGA-89q3-4323-h966CGA-8hjw-7xvf-hvj5CGA-8jh9-m78c-cf8wCGA-8jrc-j9m9-gpjwCGA-8m4j-83m9-5gv9CGA-8p3v-76jc-wwr2CGA-8qj4-2pmv-pw89CGA-8r9h-fm77-4hmgCGA-8rj2-498c-pm79CGA-8rr8-4q66-3j2gCGA-8v24-pqfh-m9qxCGA-8vrq-w74q-x6gxCGA-8w74-f2f2-xv5pCGA-8xh5-5wjp-3gg5CGA-8xr3-5264-rphxCGA-8xvw-jx2h-fwv8CGA-93cw-f67m-32j2CGA-95g9-9qfv-j8cjCGA-95rj-x87p-5mm7CGA-95w3-prm5-xrvgCGA-95w3-vvjg-6p6pCGA-966j-4j55-j92jCGA-99p5-467g-rwgpCGA-99rx-r48g-g4h4CGA-9g8m-r78f-55f5CGA-9j2q-5898-xw7jCGA-9rh6-h9mj-w57qCGA-9xcw-96hq-fpm9CGA-9xg5-xqwr-xg6gCGA-c3rr-f8j4-q265CGA-c644-v9x8-fm4jCGA-c6fg-hhcp-f5wjCGA-c97h-m3rg-9q6gCGA-c9vj-pvx4-fmrvCGA-cfv6-84xh-jgwvCGA-ch8r-2fpj-3hr6CGA-cpjj-qwcq-8jfxCGA-cvj7-r75q-hqx4CGA-cw3p-g2gc-xf74CGA-cw64-6qxf-7jm9CGA-cw8f-qpmq-7763CGA-f239-gj6q-q5fmCGA-f393-5rqj-w688CGA-f4cm-wwr6-f7pqCGA-f84q-jv9q-rxf5CGA-ff2x-jf4x-gm85CGA-fpfg-vhc5-jhfqCGA-fpg7-288r-gxqfCGA-fqfv-w695-j2h6CGA-frrp-rfh6-hwhfCGA-g36h-5r3p-pvwmCGA-g44p-g45m-3rx3CGA-g456-jrxp-cpg7CGA-g9q6-c4fh-cp6xCGA-gcm9-mwj8-gff4CGA-ggjx-594j-rm8mCGA-ggwm-xpmq-54wpCGA-gj9g-fvp9-gq48CGA-gpj8-789f-346mCGA-gqgv-5fcv-mq2hCGA-gqhf-cmf2-m747CGA-grxj-rx9r-rjrpCGA-gvwx-rjpw-7hvcCGA-gx6g-47h3-6v2cCGA-h2qr-2cg3-wxr2CGA-h32v-68c8-2gg3CGA-h5wm-4pcc-hx2hCGA-h8r4-hxp7-f63hCGA-hh7c-67m2-mjfrCGA-hhcx-gv6v-q8pvCGA-hjvc-35hr-vrj4CGA-hmwm-8vvf-9669CGA-hrjm-hvq7-vgv6CGA-hvfj-cfch-mh62CGA-hwv4-pqwx-xphxCGA-hx38-qxhr-xgmgCGA-hxm6-4fmq-rxvgCGA-j23f-29hm-5wjrCGA-j4xr-69f5-j48wCGA-j5mm-rm84-w5g3CGA-j6r6-mww5-hm6cCGA-j87w-qg65-x2x8CGA-jc94-jf4h-65vgCGA-jcv9-v6wv-pj45CGA-jf5j-f4pc-5xjfCGA-jmg5-4qhx-fvgrCGA-jq5r-mr8m-vwjgCGA-jwrq-vxmm-xpgjCGA-m4pf-g2x7-gqchCGA-m4r8-wrrr-6rp8CGA-m4rv-96w3-4cvcCGA-m759-3x7r-5fv7CGA-m7ww-66fh-959jCGA-m94q-99mm-8rmmCGA-m97r-7h8m-rp8rCGA-mhp5-xgqr-3c2fCGA-mp82-3p7q-q87fCGA-mq55-mr75-6mh6CGA-mqr9-8cq2-xqpcCGA-mw53-xm35-2pqmCGA-mwxr-42p4-jpcrCGA-mxc2-3cj6-4qwjCGA-mxff-37xv-5r3gCGA-p2f5-6g83-rxc5CGA-p3f4-2ffc-f7wqCGA-p3h7-vvp8-v7f5CGA-p47f-m27r-65f3CGA-p69w-xhx6-4rj2CGA-p7cm-fvr5-8g4pCGA-p7rf-5p2q-jgxqCGA-p8g2-ggf6-2fxfCGA-p8hc-wm68-4jwvCGA-p986-hcxr-cc35CGA-pf4q-98h5-7cwwCGA-phgg-rh85-mmprCGA-pjgv-7gp8-rjhhCGA-pm88-9h36-7w48CGA-pmx6-4w84-x7wxCGA-pqf9-288h-7phpCGA-px2q-mcmw-79g4CGA-q37p-q93q-jg9wCGA-q3f8-cpg3-pc4fCGA-q8f2-cv9j-mcpqCGA-q9vh-xr3x-xcgvCGA-qfgr-3x68-2mv9CGA-qfj3-84wg-v4fhCGA-qfx7-jgmp-hccfCGA-qg47-6h9r-5xg5CGA-qgqf-hvj3-cfwcCGA-qm48-7774-x4g7CGA-qr6h-c7mh-gwg9CGA-qrcp-35p6-hq3vCGA-qrfx-c278-4f56CGA-qvpg-64wr-qj64CGA-qww5-fc73-jv8fCGA-r2x2-qc3g-hj6qCGA-r3gq-9j76-pgpmCGA-r4g3-j845-qrv5CGA-r4vv-qj3j-cfw8CGA-r582-3m3j-c2gjCGA-r6r5-w5g2-xpcpCGA-r6xq-fx7f-4c95CGA-r8c7-wq57-xq2vCGA-r8hv-qxhj-3wcxCGA-r9mj-xf2f-8rrmCGA-rc73-mmf2-hqq7CGA-rf4p-q9xw-jm72CGA-rg7c-3hq5-grpgCGA-rgfj-5q49-4mj8CGA-rgxv-4h99-3f89CGA-rhfw-c4rj-2rhfCGA-rhp7-xq4v-jgwmCGA-rhw7-wmx8-4gw6CGA-rjj9-jfvq-4cxcCGA-rjwp-45w6-55wwCGA-rm2g-vxh6-mwj9CGA-rmgx-pr7f-jwghCGA-rqfv-vhhm-xfg8CGA-rqh7-9p32-cf6jCGA-rr6x-247r-2rhxCGA-rrq5-266g-vghmCGA-rrq7-4xfm-mmmrCGA-rv46-mfg7-2x4vCGA-rx3r-7mpr-p4xxCGA-rxq9-3cph-rmggCGA-v46r-p537-23v3CGA-v5mr-hv4q-2w5cCGA-v5r7-hmmg-h3hxCGA-v692-g2p4-wx8mCGA-v7f7-q7wv-cm7hCGA-v7v4-3254-5rfvCGA-v7x6-vjwx-mhxwCGA-v8hm-gg3v-8m49CGA-vc94-58gm-hxchCGA-vc9r-599j-63jhCGA-vchj-f5jc-cp5wCGA-vg3m-qqf7-qx7qCGA-vgcc-3vfj-94m7CGA-vh9j-jfrx-pwjrCGA-vhm6-3vvf-q776CGA-vjq6-h2g2-x6r4CGA-vm83-rjg8-pc4jCGA-vm84-59xh-qmhqCGA-vm8m-jv2w-gmmwCGA-vq3q-xj7j-v8gwCGA-vv5g-2g64-jqm3CGA-vv9x-9xg7-3rqmCGA-vvx5-5jvm-jqmcCGA-vwh7-7pf8-83xjCGA-vwhr-5523-j73vCGA-vx7p-g88q-88h4CGA-vxr8-fr55-c9x8CGA-w34h-vvvh-pgwqCGA-w56v-5gp2-pjqpCGA-w6gc-7mwj-rxm7CGA-w7xm-jj7w-8j55CGA-w972-grwg-8x2pCGA-w988-9q85-mpqgCGA-w99w-f7jx-q658CGA-w9fx-93q5-4pg8CGA-wcq9-hxwh-3hv8CGA-wgpq-rv23-rg4rCGA-wmm9-f33j-m334CGA-wmmc-5jx7-4jp2CGA-wp33-vph8-j3crCGA-wrph-82mx-w8ggCGA-wv9v-4727-2hmvCGA-x35x-2qf7-h3qcCGA-x3c3-pwqv-cqr2CGA-x3g5-4wjv-98qgCGA-x4rv-m2h9-cmrpCGA-x4x9-6877-mfrpCGA-x5jj-pjgw-8gqfCGA-x5p3-3xw9-wh7gCGA-x78c-ph8r-p4pcCGA-x92q-hv37-mgj8CGA-x9hq-hxq2-jgp4CGA-xc26-47ww-4w7cCGA-xc5m-5pcc-jr7qCGA-xcgc-f336-7w82CGA-xhqx-rchh-2mf7CGA-xj7c-74c8-2mqgCGA-xjj9-wh8r-5c92CGA-xjmh-mgc5-2mqvCGA-xjmw-r49m-6rrmCGA-xqqc-gv46-ggj3CGA-xvx7-3q59-cqj8CGA-xw83-h73x-r8cxCGA-3qcp-h5vw-gc6qCGA-9rm7-xp55-23ffCGA-gpcp-hqvq-78v8CGA-5fmp-c996-p6xfCGA-7363-mrmv-992fCGA-8ff8-m442-j33xCGA-w29f-872j-hrcxCGA-2h64-g6c5-r2cqCGA-3x6w-rwj6-gm3hCGA-7jjq-4xxc-7p2pCGA-cqqj-q53q-rjh7CGA-qpm3-9pw5-pf66CGA-v36c-87pp-j973CGA-xx42-2mxh-v9c7
Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 12 Jun 2026, 18:01
Last modified:11 Sept 2026, 12:08
Vulnerability Summary
Overall Risk (default)
medium
35/100 CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.53% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
12 Jun 2026, 18:01
Published
Vulnerability first disclosed
11 Sept 2026, 12:08
Last Modified
Vulnerability information updated
Description
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Trends
Current EPSS score: 0.53%• Percentile: 44%
Techniques & Countermeasures
- CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected Systems
- chainguard•airflow-2
all
- chainguard•airflow-core-2
all
- chainguard•arangodb-3.11
< 3.11.14.4-r8
- chainguard•argo-workflows-ui-3.6
< 3.6.19-r7
- chainguard•argo-workflows-ui-3.7
< 3.7.15-r1
- chainguard•argo-workflows-ui-4.0
< 4.0.6-r1 | < 4.0.11-r0
- chainguard•commercial-gitlab-rails-ee-19.1
all
- chainguard•commercial-gitlab-rails-ee-19.2
all
- chainguard•commercial-gitlab-rails-ee-19.3
all
- chainguard•commercial-gitlab-rails-ee-fips-19.1
all
- chainguard•commercial-gitlab-rails-ee-fips-19.3
all
- chainguard•dbgate
< 7.2.0-r1
- chainguard•drupal-11.3
< 11.3.13-r3
- chainguard•gemini-cli
< 0.47.0-r0
- chainguard•gitlab-rails-ce-18.1
all
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.11
< 18.11.6-r7
- chainguard•gitlab-rails-ce-18.5
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
all | < 19.0.3-r1
- chainguard•gitlab-rails-ce-19.1
all | < 19.1.7-r6
- chainguard•gitlab-rails-ce-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-19.3
< 19.3.1-r6
- chainguard•gitlab-rails-ce-fips-18.1
all | < 18.1.6-r15
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.11
< 18.11.6-r7
- chainguard•gitlab-rails-ce-fips-18.5
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
all
- chainguard•gitlab-rails-ce-fips-19.1
all | < 19.1.1-r1 | < 19.1.7-r7
- chainguard•gitlab-rails-ce-fips-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-fips-19.3
< 19.3.1-r3
- chainguard•jitsucom-jitsu-console
< 2.11.0-r27
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kibana-7
all
Showing first 50 affected entries in server-rendered view.
References (70)
- https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
- https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
- https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
- https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
- https://www.npmjs.com/package/form-data
- https://cwe.mitre.org/data/definitions/93.html
- https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
- https://nvd.nist.gov/vuln/detail/CVE-2026-12143
- https://github.com/form-data/form-data
- https://access.redhat.com/security/cve/CVE-2026-12143
- https://bugzilla.redhat.com/show_bug.cgi?id=2488480
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json
- https://access.redhat.com/errata/RHSA-2026:33155
- https://access.redhat.com/errata/RHSA-2026:33160
- https://access.redhat.com/errata/RHSA-2026:33163
- https://access.redhat.com/errata/RHSA-2026:33173
- https://access.redhat.com/errata/RHSA-2026:33183
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:37577
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:41929
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:42146
- https://access.redhat.com/errata/RHSA-2026:42796
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:50300
- https://access.redhat.com/errata/RHSA-2026:44263
- https://access.redhat.com/errata/RHSA-2026:44267
- https://access.redhat.com/errata/RHSA-2026:48693
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:43052
- https://security-tracker.debian.org/tracker/CVE-2026-12143
- https://access.redhat.com/errata/RHSA-2026:56338
- https://access.redhat.com/errata/RHSA-2026:54770
- https://access.redhat.com/errata/RHSA-2026:56431
- https://access.redhat.com/errata/RHSA-2026:56366
- https://access.redhat.com/errata/RHSA-2026:57013
- https://access.redhat.com/errata/RHSA-2026:57590
- https://access.redhat.com/errata/RHSA-2026:59136
- https://access.redhat.com/errata/RHSA-2026:59155
- https://access.redhat.com/errata/RHSA-2026:59153
- https://access.redhat.com/errata/RHSA-2026:57545
- https://access.redhat.com/errata/RHSA-2026:57801
- https://access.redhat.com/errata/RHSA-2026:59557
- https://access.redhat.com/errata/RHSA-2026:59556
- https://access.redhat.com/errata/RHSA-2026:59579
- https://access.redhat.com/errata/RHSA-2026:59558
- https://access.redhat.com/errata/RHSA-2026:59559
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/errata/RHSA-2026:60477
- https://access.redhat.com/errata/RHSA-2026:60446
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/errata/RHSA-2026:63355
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12143.json
- https://access.redhat.com/errata/RHSA-2026:63373
- https://access.redhat.com/errata/RHSA-2026:63047
- https://access.redhat.com/errata/RHSA-2026:66003
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/errata/RHSA-2026:66488