# form-data (npm) vulnerabilities 2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.6 (Jun 12, 2026): no advisory affects it - Newest unaffected release: 4.0.6 (Jun 12, 2026), the latest release - Weekly downloads: 227.2M - Dependents: 271.7K - Releases: 53 since 0.0.0 (May 16, 2011) - Registry: https://www.npmjs.com/package/form-data - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-12143: 0.0.0 to 2.5.5 (2.5.6 is outside it); 3.0.0 to 3.0.4 (3.0.5 is outside it); 4.0.0 to 4.0.5 (4.0.6 is outside it) - CVE-2025-7783: 0.0.0 to 2.5.3 (2.5.4 is outside it); 3.0.0 to 3.0.3 (3.0.4 is outside it); 4.0.0 to 4.0.3 (4.0.4 is outside it) ## Advisories (2) ### [CVE-2026-12143](https://cve.now/CVE-2026-12143): form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) - Severity: High 8.7 - Published: Jun 12, 2026 - Affected: fixed in 2.5.6; from 3.0.0, fixed in 3.0.5; from 4.0.0, fixed in 4.0.6; fixed in 2.5.6; from 3.0.0, fixed in 3.0.5; from 4.0.0, fixed in 4.0.6. - Fixed in 2.5.6 (released Jun 12, 2026, the day of disclosure), 3.0.5 (released Jun 12, 2026, the day of disclosure) and 4.0.6 (released Jun 12, 2026, the day of disclosure). - The latest release, 4.0.6, is not affected. - 46% of form-data downloads last week were affected versions (121M). ### [CVE-2025-7783](https://cve.now/CVE-2025-7783): Usage of unsafe random function in form-data for choosing boundary - Severity: Critical 9.4 - Published: Jul 18, 2025 - Affected: fixed in 2.5.4; from 3.0.0, fixed in 3.0.4; from 4.0.0, fixed in 4.0.4. - Fixed in 2.5.4 (released Jul 17, 2025, 1 day before disclosure), 3.0.4 (released Jul 17, 2025, 1 day before disclosure) and 4.0.4 (released Jul 17, 2025, 1 day before disclosure). - The latest release, 4.0.6, is not affected. - 20% of form-data downloads last week were affected versions (51.4M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/form-data Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.