This might be a false positive, but package-lock.json around line 11817 looked worth a second pair of eyes.
The form-data library before version 4.0.6 inserts field names and filenames verbatim into the Content‑Disposition header without escaping CR, LF, or ". An attacker who can control these values can inject CRLF sequences, terminate the header line, and add or override downstream form fields. This CWE‑93 CRLF injection can lead to request smuggling, privilege escalation, or other parsing‑based attacks when user‑supplied data is used as multipart field names or filenames. Severity is HIGH.
Something like this might fix it:
Upgrade form-data to a fixed version (>=4.0.6, or >=3.0.5, or >=2.5.6) by updating the dependency in package.json and running npm install. This ensures the library properly escapes CR, LF, and " characters in field names and filenames.
For reference: rule CVE-2026-12143. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
package-lock.jsonaround line 11817 looked worth a second pair of eyes.The form-data library before version 4.0.6 inserts field names and filenames verbatim into the Content‑Disposition header without escaping CR, LF, or ". An attacker who can control these values can inject CRLF sequences, terminate the header line, and add or override downstream form fields. This CWE‑93 CRLF injection can lead to request smuggling, privilege escalation, or other parsing‑based attacks when user‑supplied data is used as multipart field names or filenames. Severity is HIGH.
Something like this might fix it:
For reference: rule
CVE-2026-12143. Rated high.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.