Executive brief
The form-data library, used to create web request bodies, is vulnerable to a flaw where it fails to properly clean user-provided field names and filenames. If an application allows users to provide these names, an attacker can inject malicious commands or extra data into the request. This could allow an attacker to bypass security checks or manipulate data sent to backend systems.
Technical details
The form-data library (CWE-93) fails to escape carriage return (\r), line feed (\n), or double quote (") characters in the 'field' name and 'filename' parameters within the Content-Disposition header. An attacker can exploit this by providing a crafted string that terminates the current header line and injects new headers or entirely new multipart sections (request smuggling). This vulnerability is reachable if an application passes untrusted input directly to the FormData#append method. The issue has been resolved in versions 2.5.6, 3.0.5, and 4.0.6 by implementing proper escaping of these control characters.
Affected products
- form-data form-data < 2.5.6, >= 3.0.0 < 3.0.5, >= 4.0.0 < 4.0.6
Timeline
- 2026-06-12: disclosed
- 2026-06-12: patched
- 2026-06-15: advisory