SECUFOCUSNOW
Home›CVE index›CVE-2026-12143
Review reviewHigh

CVE-2026-12143

form-data form-data, Cryostat 4 on RHEL 9, Red Hat Data Grid 8.6.2

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional...

CVSS
8.7
EPSS
0.53%
42.2% percentile
CISA KEV
Not listed
Published
2026.06.13
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.53%
Technical severityCVSS 8.7

Vulnerability overview

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional...

Affected product and versions

Product
form-data form-data, Cryostat 4 on RHEL 9, Red Hat Data Grid 8.6.2
Affected versions
< 2.5.6, >= 3.0.0 < 3.0.5, >= 4.0.0 < 4.0.6
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that form-data form-data, Cryostat 4 on RHEL 9, Red Hat Data Grid 8.6.2 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-93
CVE-2026-12143 — form-data form-data, Cryostat 4 on RHEL 9, Red Hat Data Grid 8.6.2 | SECUFOCUS NOW