@rootio/form-data vulnerabilities (Root)

2 vulnerabilities.

• @rootio/form-data Root form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) CVE-2026-12143 Fix available 8.7 HighJune 12, 2026
• @rootio/form-data Root Usage of unsafe random function in form-data for choosing boundary CVE-2025-7783 Public exploitFix available 9.4 CriticalJuly 18, 2025