Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the form-data library's handling of field names and filenames when constructing multipart/form-data payloads. The root cause is the lack of escaping for Carriage Return (CR) and Line Feed (LF) characters in the field and filename parameters. An attacker can supply a specially crafted string containing \r\n to the FormData.prototype.append function. This input is then used by the internal functions FormData.prototype._multiPartHeader and FormData.prototype._getContentDisposition to construct the Content-Disposition header. Because the input is not sanitized, the CRLF characters are interpreted as the end of a header line, allowing the attacker to inject new headers or even new multipart body parts. This can lead to various security issues, such as session fixation, cross-site scripting (XSS) if the backend reflects the headers, or bypassing security controls by injecting fields like is_admin=true.
The patch addresses this by introducing a new function, escapeHeaderParam, which escapes \r, \n, and " characters in the field name and filename before they are included in the header. The vulnerable functions _multiPartHeader and _getContentDisposition were modified to use this new escaping function, thus mitigating the CRLF injection vulnerability.
FormData.prototype.appendlib/form_data.js
FormData.prototype._multiPartHeaderlib/form_data.js
FormData.prototype._getContentDispositionlib/form_data.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| form-data | npm | < 2.5.6 | 2.5.6 |
| form-data | npm | >= 3.0.0, < 3.0.5 | 3.0.5 |
| form-data | npm | >= 4.0.0, < 4.0.6 | 4.0.6 |