The form-data library concatenates the field name and filename arguments into the Content‑Disposition header without escaping carriage return, line feed, or double‑quote characters. This omission allows an attacker-controlled value to terminate the header line and inject arbitrary additional headers or even smuggle entire multipart parts into the request. In practice, an attacker can overwrite downstream form fields such as "is_admin=true", enabling privilege escalation or other unauthorized actions. The weakness is a classic CRLF injection flaw (CWE‑93).

Any Node.js or JavaScript application that relies on the form-data package, up to version 4.0.5, is affected. The vulnerability is fixed in the newer releases 2.5.6, 3.0.5, and 4.0.6. Applications that employ form-data to build multipart requests from user-supplied field names or filenames are at risk.

The CVSS score of 8.7 marks this issue as high severity. No EPSS score is available, and the condition is not listed in CISA KEV. Based on the description, the likely attack vector is in services that receive user input—such as JSON keys or file names—and forward them directly to FormData#append. If that occurs, an attacker can manipulate the downstream request, potentially gaining unauthorized access or data tampering.