node-form-data vulnerabilities (Debian)

2 vulnerabilities.

• node-form-data Debian form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) CVE-2026-12143 Fix available 8.7 HighJune 12, 2026
• node-form-data Debian Usage of unsafe random function in form-data for choosing boundary CVE-2025-7783 Public exploitFix available 9.4 CriticalJuly 18, 2025