form-data: Improper Neutralization of CRLF Sequences

What to do

1. Update form-data to 2.5.6 or 3.0.5 or 4.0.6, whichever matches your release line, or a later version.
2. Read the advisory on github.com for workarounds and exact fixed builds.
3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

NoneNo data is disclosed.

Integrity

HighData or code can be modified at will.

Availability

NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Scored by CNA.

Official description

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Neutralization of CRLF Sequences

Timeline

1. June 12, 2026CVE record published.
2. June 12, 2026CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: partial).
3. September 11, 2026Record last changed materially (score, affected products, status or references).

References

Recent Improper Neutralization of CRLF Sequences vulnerabilities

• 9.1 Critical severity

  Metrics::Any::Adapter::DogStatsd: Improper Neutralization of CRLF Sequences

  CVE-2026-50638Jun 10, 2026Pevans
• 8.2 High severity

  Metrics::Any::Adapter::Statsd: Improper Neutralization of CRLF Sequences

  CVE-2026-50637Jun 10, 2026Pevans
• 9.1 Critical severity

  DataDog::DogStatsd: Improper Neutralization of CRLF Sequences

  CVE-2026-9270Jun 5, 2026Binary
• 9.8 Critical severity

  DataDog::DogStatsd: Improper Neutralization of CRLF Sequences

  CVE-2026-11362Jun 5, 2026Binary
• 9.8 Critical severity

  libinput: Improper Neutralization of CRLF Sequences

  CVE-2026-50292Jun 4, 2026Freedesktop
• 7.5 High severity

  Etsy::StatsD: Improper Neutralization of CRLF Sequences

  CVE-2026-46741Jun 4, 2026Sanbeg

Spotted an error? Tell us.