Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-12143 is being patched in parallel across OpenHands and mem0. Same vulnerability, two AI tooling repos simultaneously. Self-hosted deployments should monitor both for patch releases.
Post summary
CVE‑2026‑12143 is currently being patched in both OpenHands and mem0; users of self‑hosted deployments should monitor for the upcoming releases.
@mem0ai Security patch → Upgrade form-data dependency to fix CVE-2026-12143 vulnerability. This release shows focus on memory integrity and trustworthiness under real-world data quirks.
Post summary
The update includes an upgrade to the form-data dependency to remediate CVE-2026-12143, focusing on memory integrity enhancements.
🚨High - form-data CRLF Injection via Unescaped Multipart Field Names and Filenames (CVE-2026-12143) The widely used form-data npm package builds multipart/form-data bodies by concatenating the field name and filename straight into the Content-Disposition header - through v4.0.5 it never escapes CR, LF, or double-quote characters. If an application passes untrusted input as a field name or filename, an attacker can inject \r\n to terminate the header line and add their own headers, or smuggle whole extra multipart parts (for example an injected is_admin field) into the request forwarded to a backend. Apps that only use fixed, trusted field names aren't affected. The fix escapes \r, \n, and " to match the WHATWG browser encoding behavior. 👉Upgrade to form-data 4.0.6, 3.0.5, or 2.5.6.
Post summary
The post discloses a CRLF injection flaw in the form-data npm package and provides a concrete patch by upgrading to specific stable releases.