{"id":1733971,"name":"form-data","ecosystem":"npm","description":"A library to create readable \"multipart/form-data\" streams. Can be used to submit forms and file uploads to other web applications.","homepage":"https://github.com/form-data/form-data#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/form-data/form-data","keywords_array":[],"namespace":null,"versions_count":53,"first_release_published_at":"2011-05-16T14:58:22.532Z","latest_release_published_at":"2026-06-12T17:37:53.689Z","latest_release_number":"4.0.6","last_synced_at":"2026-09-13T07:15:43.812Z","created_at":"2022-04-09T15:48:33.935Z","updated_at":"2026-09-14T05:16:57.019Z","registry_url":"https://www.npmjs.com/package/form-data","install_command":"npm install form-data","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"v2-backport":"2.5.6","latest":"4.0.6","v3-backport":"3.0.5"},"contentPolicy":null},"repo_metadata":{"id":1501843,"uuid":"1755793","full_name":"form-data/form-data","owner":"form-data","description":"A module to create readable `\"multipart/form-data\"` streams.  Can be used to submit forms and file uploads to other web applications. ","archived":false,"fork":false,"pushed_at":"2026-06-12T18:13:20.000Z","size":453,"stargazers_count":2355,"open_issues_count":141,"forks_count":402,"subscribers_count":24,"default_branch":"master","last_synced_at":"2026-08-30T06:38:52.711Z","etag":null,"topics":["formdata","nodejs","server","stream","xhr2-fd"],"latest_commit_sha":null,"homepage":"https://www.npmjs.com/form-data","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/form-data.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"License","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2011-05-16T14:55:45.000Z","updated_at":"2026-08-26T21:20:11.000Z","dependencies_parsed_at":"2026-08-05T18:40:56.926Z","dependency_job_id":null,"html_url":"https://github.com/form-data/form-data","commit_stats":{"total_commits":207,"total_committers":43,"mean_commits":4.813953488372093,"dds":0.5217391304347826,"last_synced_commit":"d04f7381b0111c707baa47190de2d48a02988b5b"},"previous_names":["felixge/node-form-data"],"tags_count":45,"template":false,"template_full_name":null,"purl":"pkg:github/form-data/form-data","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/form-data","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/sbom","scorecard":{"id":396362,"data":{"date":"2025-08-11","repo":{"name":"github.com/form-data/form-data","commit":"16e00765342106876f98a1c9703314006c9e937a"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.9,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":10,"reason":"11 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":0,"reason":"Found 2/29 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-aught.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/node-aught.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-pretest.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/node-pretest.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-tens.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/node-tens.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rebase.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/rebase.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/rebase.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/rebase.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/require-allow-edits.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/form-data/form-data/require-allow-edits.yml/master?enable=pin","Info:   0 out of   1 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   5 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/rebase.yml:11","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/rebase.yml:12","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/require-allow-edits.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-aught.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-pretest.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/node-tens.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/rebase.yml:6","Info: topLevel 'contents' permission set to 'read': .github/workflows/require-allow-edits.yml:6"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: License:0","Info: FSF or OSI recognized license: MIT License: License:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-18T19:06:46.697Z","repository_id":1501843,"created_at":"2025-08-18T19:06:46.697Z","updated_at":"2025-08-18T19:06:46.697Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36994292,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-31T02:00:07.497Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"form-data","name":"FormData","uuid":"13501535","kind":"organization","description":"A library to create readable \"multipart/form-data\" streams.","email":null,"website":"http://form-data.github.io","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/13501535?v=4","repositories_count":3,"last_synced_at":"2026-09-06T00:53:41.072Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/form-data","funding_links":[],"total_stars":2390,"followers":12,"following":0,"created_at":"2022-11-02T16:19:13.024Z","updated_at":"2026-09-06T00:53:41.090Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/form-data","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/form-data/repositories"},"tags":[{"name":"v4.0.6","sha":"64190db548c0179e37206858e39f27cf513e9435","kind":"tag","published_at":"2026-06-12T17:32:09.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.6","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.6/manifests"},{"name":"v3.0.5","sha":"be3f3cf553978bac15a5182f1f3c3d2d38ccf229","kind":"tag","published_at":"2026-06-12T17:31:38.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.5","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.5/manifests"},{"name":"v2.5.6","sha":"c7133499c2ee1b80c678e411244f4442bf902045","kind":"tag","published_at":"2026-06-12T17:30:50.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.6","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.6/manifests"},{"name":"v4.0.5","sha":"68ff7dda8834d6de095a7008cef0e03bc252ca98","kind":"tag","published_at":"2025-11-17T04:15:20.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.5","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.5/manifests"},{"name":"v2.5.5","sha":"40de5a74209992979f6695d894c1d554ddb72f29","kind":"tag","published_at":"2025-07-18T22:52:38.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.5","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.5/manifests"},{"name":"v2.5.4","sha":"efe6c2693159084b18c58648e77203d1d810395b","kind":"tag","published_at":"2025-07-17T21:41:39.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.4","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.4/manifests"},{"name":"v3.0.4","sha":"9c82fcdf0858b2764060a87803a55375ffbee6ed","kind":"tag","published_at":"2025-07-17T06:16:44.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.4","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.4/manifests"},{"name":"v4.0.4","sha":"41996f5ac73a867046d48512cab62e64fc846dad","kind":"tag","published_at":"2025-07-17T04:53:37.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.4","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.4/manifests"},{"name":"v4.0.3","sha":"d8d67dc8ac79285154edf7d3f57dbab593b9a146","kind":"tag","published_at":"2025-06-05T14:50:55.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.3","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.3/manifests"},{"name":"v4.0.2","sha":"7465e1337244831e91f9a2413a2bf49bdc2a2e04","kind":"tag","published_at":"2025-02-14T23:23:18.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.2","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.2/manifests"},{"name":"v3.0.3","sha":"e46f09bb5338bff090f5cceea5119a8b37c9b147","kind":"tag","published_at":"2025-02-14T22:59:50.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.3","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.3/manifests"},{"name":"v2.5.3","sha":"9457283e1dce6122adc908fdd7442cfc54cabe7a","kind":"tag","published_at":"2025-02-14T21:54:41.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.3","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.3/manifests"},{"name":"v4.0.1","sha":"d04f7381b0111c707baa47190de2d48a02988b5b","kind":"tag","published_at":"2024-10-10T03:49:32.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.1","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.1/manifests"},{"name":"v3.0.2","sha":"f06b0d85d10bc942b3bf586b01ace6e874ac61b3","kind":"tag","published_at":"2024-10-10T03:48:37.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.2","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.2/manifests"},{"name":"v2.5.2","sha":"7020dd4c1260370abc40e86e3dfe49c5d576fbda","kind":"tag","published_at":"2024-10-10T03:46:03.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.2","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.2/manifests"},{"name":"v4.0.0","sha":"53adbd81e9bde27007b28083068f2fc8272614dc","kind":"tag","published_at":"2021-02-15T17:36:57.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v4.0.0","html_url":"https://github.com/form-data/form-data/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v4.0.0/manifests"},{"name":"v3.0.1","sha":"c72ad6728ae394e55c0f7a025864429edd656879","kind":"tag","published_at":"2021-02-15T17:33:32.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.1","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"5c9b3a94aad8482ad8126cd7405a3060cd8e022e","kind":"tag","published_at":"2019-11-06T07:54:24.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v3.0.0","html_url":"https://github.com/form-data/form-data/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v3.0.0/manifests"},{"name":"v2.5.1","sha":"8ce81f56cccf5466363a5eff135ad394a929f59b","kind":"tag","published_at":"2019-08-29T06:47:42.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.1","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.1/manifests"},{"name":"v2.5.0","sha":"905f173a3f785e8d312998e765634ee451ca5f42","kind":"tag","published_at":"2019-07-04T04:25:07.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.5.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.5.0/manifests"},{"name":"v2.4.0","sha":"8512eef436e28372f5bc88de3ca76a9cb46e6847","kind":"commit","published_at":"2019-06-19T07:12:09.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.4.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.4.0/manifests"},{"name":"v2.3.2","sha":"017017813917aaeee928a50e6c7e5f3af5ab7c2f","kind":"tag","published_at":"2018-02-14T00:32:43.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.3.2","html_url":"https://github.com/form-data/form-data/releases/tag/v2.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.2/manifests"},{"name":"v2.3.1","sha":"7629e30d4175fa07965a59f70ba5022172f9494a","kind":"tag","published_at":"2017-08-24T19:24:44.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.3.1","html_url":"https://github.com/form-data/form-data/releases/tag/v2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.1/manifests"},{"name":"v2.3.0","sha":"bdd828417ae74a3b7fc6a16b01ab8f4fb96c4c0b","kind":"tag","published_at":"2017-08-24T14:20:29.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.3.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.3.0/manifests"},{"name":"v2.2.0","sha":"6edf2cd4fdf4e61aba23bd538025fd8746a94fa7","kind":"tag","published_at":"2017-06-11T07:52:32.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.2.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.2.0/manifests"},{"name":"v2.1.4","sha":"19748778e2cd05e2ddc95409fcbbf0461a868775","kind":"tag","published_at":"2017-04-09T06:56:26.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.1.4","html_url":"https://github.com/form-data/form-data/releases/tag/v2.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.4/manifests"},{"name":"v2.1.3","sha":"19748778e2cd05e2ddc95409fcbbf0461a868775","kind":"tag","published_at":"2017-04-09T04:08:33.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.1.3","html_url":"https://github.com/form-data/form-data/releases/tag/v2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.3/manifests"},{"name":"2.1.3","sha":"19748778e2cd05e2ddc95409fcbbf0461a868775","kind":"commit","published_at":"2017-04-09T03:36:14.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/2.1.3","html_url":"https://github.com/form-data/form-data/releases/tag/2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/2.1.3/manifests"},{"name":"v2.1.2","sha":"03444d21961a7a44cdc2eae11ee3630f6969023d","kind":"tag","published_at":"2016-11-08T03:21:40.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.1.2","html_url":"https://github.com/form-data/form-data/releases/tag/v2.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.2/manifests"},{"name":"v2.1.1","sha":"ebee8412f79798b87fd3ebed44748c1ca06fc1ac","kind":"tag","published_at":"2016-10-04T05:59:43.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.1.1","html_url":"https://github.com/form-data/form-data/releases/tag/v2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.1/manifests"},{"name":"v2.1.0","sha":"4718daefac2d16bfb3b32b9761c356cdd2461d71","kind":"tag","published_at":"2016-09-25T22:12:02.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.1.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.1.0/manifests"},{"name":"v2.0.0","sha":"652b16ff5b9077bdf65eb66b67286c823c2a1040","kind":"tag","published_at":"2016-09-17T06:03:18.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v2.0.0","html_url":"https://github.com/form-data/form-data/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v2.0.0/manifests"},{"name":"v1.0.0","sha":"6fd2c6555b5c685dbd791f364486df45472f70a4","kind":"tag","published_at":"2016-08-26T08:50:13.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v1.0.0","html_url":"https://github.com/form-data/form-data/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0/manifests"},{"name":"v1.0.0-rc4","sha":"f73996e0508ee2d4b2b376276adfac1de4188ac2","kind":"tag","published_at":"2016-03-15T16:34:23.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v1.0.0-rc4","html_url":"https://github.com/form-data/form-data/releases/tag/v1.0.0-rc4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v1.0.0-rc4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc4/manifests"},{"name":"v1.0.0-rc3","sha":"c174f1b7f3a78a00ec5af0360469280445e37804","kind":"tag","published_at":"2015-07-30T04:07:34.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v1.0.0-rc3","html_url":"https://github.com/form-data/form-data/releases/tag/v1.0.0-rc3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v1.0.0-rc3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc3/manifests"},{"name":"v1.0.0-rc2","sha":"9f29fefe9633f3adae72d6416fd6822c060ff6b6","kind":"commit","published_at":"2015-07-22T02:34:44.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v1.0.0-rc2","html_url":"https://github.com/form-data/form-data/releases/tag/v1.0.0-rc2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v1.0.0-rc2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc2/manifests"},{"name":"v1.0.0-rc1","sha":"e6650a4c078fd09c130ed712848d71d8609c6518","kind":"commit","published_at":"2015-06-13T15:48:11.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/v1.0.0-rc1","html_url":"https://github.com/form-data/form-data/releases/tag/v1.0.0-rc1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@v1.0.0-rc1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/v1.0.0-rc1/manifests"},{"name":"0.2","sha":"16f92b30f5325c5b5352dc346ca1bc07ba4bcb33","kind":"commit","published_at":"2014-12-06T21:12:17.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.2","html_url":"https://github.com/form-data/form-data/releases/tag/0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.2/manifests"},{"name":"0.1.4","sha":"5f5f4809ea685f32658809fa0f13d7eface0e45a","kind":"commit","published_at":"2014-06-24T06:33:24.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.1.4","html_url":"https://github.com/form-data/form-data/releases/tag/0.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.4/manifests"},{"name":"0.1.3","sha":"3f4949b37f8ae4805ec9f46f792d6659a591b7d9","kind":"tag","published_at":"2014-06-17T16:52:13.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.1.3","html_url":"https://github.com/form-data/form-data/releases/tag/0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.3/manifests"},{"name":"0.1.2","sha":"db13d8ca8e0e9d222ef1d175606a18b7ae814081","kind":"tag","published_at":"2013-10-03T04:09:47.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.1.2","html_url":"https://github.com/form-data/form-data/releases/tag/0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.2/manifests"},{"name":"0.1.1","sha":"e3dae1526bd3c3b9d7aff6075abdaac12c3cc60f","kind":"tag","published_at":"2013-08-22T04:24:17.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.1.1","html_url":"https://github.com/form-data/form-data/releases/tag/0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.1/manifests"},{"name":"0.1.0","sha":"fdc52f3fa32198da44644bb158e6f5764feb3767","kind":"tag","published_at":"2013-07-08T18:48:12.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.1.0","html_url":"https://github.com/form-data/form-data/releases/tag/0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.1.0/manifests"},{"name":"0.0.10","sha":"932b39b773e49edcb2c5d2e58fe389ab6c42f47c","kind":"tag","published_at":"2013-05-09T05:36:20.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.0.10","html_url":"https://github.com/form-data/form-data/releases/tag/0.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.0.10/manifests"},{"name":"0.0.9","sha":"2e033e0e4be7c1457be090cd9b2996f19d8fb665","kind":"tag","published_at":"2013-04-30T00:51:22.000Z","download_url":"https://codeload.github.com/form-data/form-data/tar.gz/0.0.9","html_url":"https://github.com/form-data/form-data/releases/tag/0.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/form-data/form-data@0.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/tags/0.0.9/manifests"}]},"repo_metadata_updated_at":"2026-09-08T07:56:31.786Z","dependent_packages_count":10194,"downloads":657765965,"downloads_period":"last-month","dependent_repos_count":1722210,"rankings":{"downloads":0.0019439677312308545,"dependent_repos_count":0.019603956275511154,"dependent_packages_count":0.009610319347352535,"stargazers_count":1.8675780133416424,"forks_count":2.01047333150071,"docker_downloads_count":0.007858010406524722,"average":0.652844599767162},"purl":"pkg:npm/form-data","advisories":[{"uuid":"GSA_kwCzR0hTQS1obXcyLTdjYzctM3F4eM4ABYrY","url":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","title":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","description":"## Summary\n\n`form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\\r`), LF (`\\n`), or `\"`. An application that uses **untrusted input as a field name or filename** therefore lets an attacker terminate the header line and either inject additional headers or smuggle whole additional multipart parts into the request the application forwards to a backend.\n\nThis is CWE-93 (CRLF injection). It is a divergence from how browsers and the WHATWG HTML spec serialize form-data (they escape these characters), so the fix is to match that behavior. Severity is **conditional**: it depends on the consuming application passing attacker-controlled data as a field name or filename. Applications that only use fixed/trusted field names are not affected.\n\n## Details\n\nIn `lib/form_data.js`, `_multiPartHeader` builds the part header as:\n\n```javascript\n'Content-Disposition': ['form-data', 'name=\"' + field + '\"'].concat(contentDisposition || [])\n```\n\nand `_getContentDisposition` builds `filename=\"' + filename + '\"'`. Neither escapes control characters, so a `\\r\\n` in `field`/`filename` ends the header line. The same applies to `\"`, which can break out of the quoted parameter.\n\n### Proof of concept\n\n```javascript\nconst FormData = require('form-data');\nconst form = new FormData();\nform.append('email\"\\r\\nX-Injected: true\\r\\nfake=\"', 'user@example.com');\nconsole.log(form.getBuffer().toString());\n```\n\nBefore the fix this emits an injected `X-Injected: true` header line. A field name that also includes `--\u003cboundary\u003e` sequences can introduce additional parts (e.g. an extra `name=\"is_admin\"` field), which a downstream parser accepts as legitimate.\n\n## Impact\n\nFor an application that uses untrusted field names/filenames:\n\n- **Field injection / override (integrity).** Inject or override fields the backend trusts (e.g. `is_admin`, `role`) — the primary demonstrated impact.\n- **Header injection** into the generated multipart part.\n\nClaims of guaranteed privilege escalation, authentication bypass, high confidentiality impact, and availability impact are application-dependent downstream consequences, not properties of `form-data` itself, and are not demonstrated by the PoC.\n\n### Severity\n\nThe demonstrated, library-attributable impact is integrity (field/header injection); there is no demonstrated confidentiality disclosure or availability impact in `form-data` itself, and exploitation requires the consuming app to feed untrusted data into field names/filenames. A Moderate (≈5.3, `I:L`) rating is also defensible given that precondition.\n\n## Patch\n\nFixed in **4.0.6**, **3.0.5**, and **2.5.6**. Users on older 0.x/1.x/2.x releases should upgrade to 2.5.6 or later.\n\nThe fix escapes `\\r`, `\\n`, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the WHATWG HTML `multipart/form-data` encoding algorithm that browsers implement. This neutralizes the injection while leaving ordinary field names (including `name[0]`, dotted, and unicode names) unchanged.\n\n## Workaround\n\nUntil upgrading, validate or reject field names/filenames that contain control characters before calling `append`:\n\n```javascript\nif (/[\\r\\n]/.test(field)) { throw new Error('invalid field name'); }\n```\n\n## Credit\n\nReported by [yueyueL](https://github.com/yueyueL).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-15T17:26:26.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://github.com/advisories/GHSA-hmw2-7cc7-3qxx"],"source_kind":"github","identifiers":["GHSA-hmw2-7cc7-3qxx","CVE-2026-12143"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-15T18:00:08.064Z","updated_at":"2026-09-14T04:01:54.617Z","epss_percentage":0.00535,"epss_percentile":0.43578,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1obXcyLTdjYzctM3F4eM4ABYrY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1obXcyLTdjYzctM3F4eM4ABYrY","packages":[{"ecosystem":"npm","package_name":"form-data","versions":[{"first_patched_version":"4.0.6","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.0.6"},{"first_patched_version":"3.0.5","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.0.5"},{"first_patched_version":"2.5.6","vulnerable_version_range":"\u003c 2.5.6"}],"purl":"pkg:npm/form-data"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1obXcyLTdjYzctM3F4eM4ABYrY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1manh2LTdycWctNzhnNM4ABKWC","url":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4","title":"form-data uses unsafe random function in form-data for choosing boundary","description":"### Summary\n\nform-data uses `Math.random()` to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker:\n1. can observe other values produced by Math.random in the target application, and\n2. can control one field of a request made using form-data\n\nBecause the values of Math.random() are pseudo-random and predictable (see: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f), an attacker who can observe a few sequential values can determine the state of the PRNG and predict future values, includes those used to generate form-data's boundary value. The allows the attacker to craft a value that contains a boundary value, allowing them to inject additional parameters into the request.\n\nThis is largely the same vulnerability as was [recently found in `undici`](https://hackerone.com/reports/2913312) by [`parrot409`](https://hackerone.com/parrot409?type=user) -- I'm not affiliated with that researcher but want to give credit where credit is due! My PoC is largely based on their work.\n\n### Details\n\nThe culprit is this line here: https://github.com/form-data/form-data/blob/426ba9ac440f95d1998dac9a5cd8d738043b048f/lib/form_data.js#L347\n\nAn attacker who is able to predict the output of Math.random() can predict this boundary value, and craft a payload that contains the boundary value, followed by another, fully attacker-controlled field. This is roughly equivalent to any sort of improper escaping vulnerability, with the caveat that the attacker must find a way to observe other Math.random() values generated by the application to solve for the state of the PRNG. However, Math.random() is used in all sorts of places that might be visible to an attacker (including by form-data itself, if the attacker can arrange for the vulnerable application to make a request to an attacker-controlled server using form-data, such as a user-controlled webhook -- the attacker could observe the boundary values from those requests to observe the Math.random() outputs). A common example would be a `x-request-id` header added by the server. These sorts of headers are often used for distributed tracing, to correlate errors across the frontend and backend. `Math.random()` is a fine place to get these sorts of IDs (in fact, [opentelemetry uses Math.random for this purpose](https://github.com/open-telemetry/opentelemetry-js/blob/2053f0d3a44631ade77ea04f656056a2c8a2ae76/packages/opentelemetry-sdk-trace-base/src/platform/node/RandomIdGenerator.ts#L22))\n\n### PoC\n\nPoC here: https://github.com/benweissmann/CVE-2025-7783-poc\n\nInstructions are in that repo. It's based on the PoC from https://hackerone.com/reports/2913312 but simplified somewhat; the vulnerable application has a more direct side-channel from which to observe Math.random() values (a separate endpoint that happens to include a randomly-generated request ID). \n\n### Impact\n\nFor an application to be vulnerable, it must:\n- Use `form-data` to send data including user-controlled data to some other system. The attacker must be able to do something malicious by adding extra parameters (that were not intended to be user-controlled) to this request. Depending on the target system's handling of repeated parameters, the attacker might be able to overwrite values in addition to appending values (some multipart form handlers deal with repeats by overwriting values instead of representing them as an array)\n- Reveal values of Math.random(). It's easiest if the attacker can observe multiple sequential values, but more complex math could recover the PRNG state to some degree of confidence with non-sequential values. \n\nIf an application is vulnerable, this allows an attacker to make arbitrary requests to internal systems.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-07-21T19:04:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.4,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","references":["https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://nvd.nist.gov/vuln/detail/CVE-2025-7783","https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/benweissmann/CVE-2025-7783-poc","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html","https://github.com/advisories/GHSA-fjxv-7rqg-78g4"],"source_kind":"github","identifiers":["GHSA-fjxv-7rqg-78g4","CVE-2025-7783"],"repository_url":"https://github.com/form-data/form-data","blast_radius":58.61920940232349,"created_at":"2025-07-21T20:08:55.157Z","updated_at":"2026-09-14T04:05:42.016Z","epss_percentage":0.01769,"epss_percentile":0.76641,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1manh2LTdycWctNzhnNM4ABKWC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1manh2LTdycWctNzhnNM4ABKWC","packages":[{"ecosystem":"npm","package_name":"form-data","versions":[{"first_patched_version":"4.0.4","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.0.4"},{"first_patched_version":"3.0.4","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.0.4"},{"first_patched_version":"2.5.4","vulnerable_version_range":"\u003c 2.5.4"}],"purl":"pkg:npm/form-data"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1manh2LTdycWctNzhnNM4ABKWC/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/form-data","docker_dependents_count":50751,"docker_downloads_count":9822316835,"usage_url":"https://repos.ecosyste.ms/usage/npm/form-data","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/form-data/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-09-07T19:05:12.322Z","issues_count":118,"pull_requests_count":59,"avg_time_to_close_issue":31154190.829787236,"avg_time_to_close_pull_request":37228543.72413793,"issues_closed_count":47,"pull_requests_closed_count":29,"pull_request_authors_count":45,"issue_authors_count":112,"avg_comments_per_issue":3.26271186440678,"avg_comments_per_pull_request":2.8813559322033897,"merged_pull_requests_count":11,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":8,"past_year_pull_requests_count":5,"past_year_avg_time_to_close_issue":557593.5,"past_year_avg_time_to_close_pull_request":null,"past_year_issues_closed_count":8,"past_year_pull_requests_closed_count":0,"past_year_pull_request_authors_count":2,"past_year_issue_authors_count":6,"past_year_avg_comments_per_issue":1.625,"past_year_avg_comments_per_pull_request":1.0,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":0,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/form-data%2Fform-data/issues","maintainers":[{"login":"DylanPiercey","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/DylanPiercey"},{"login":"alexindigo","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/alexindigo"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/form-data/codemeta","maintainers":[{"uuid":"ljharb","login":"ljharb","name":null,"email":"ljharb@gmail.com","url":null,"packages_count":567,"html_url":"https://www.npmjs.com/~ljharb","role":null,"created_at":"2024-10-31T08:37:57.169Z","updated_at":"2024-10-31T08:37:57.169Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ljharb/packages"},{"uuid":"dylanpiercey","login":"dylanpiercey","name":null,"email":"pierceydylan@gmail.com","url":null,"packages_count":434,"html_url":"https://www.npmjs.com/~dylanpiercey","role":null,"created_at":"2022-11-10T11:49:26.348Z","updated_at":"2022-11-10T11:49:26.348Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/dylanpiercey/packages"},{"uuid":"niftylettuce","login":"niftylettuce","name":null,"email":"niftylettuce@gmail.com","url":null,"packages_count":305,"html_url":"https://www.npmjs.com/~niftylettuce","role":null,"created_at":"2022-11-10T11:49:26.336Z","updated_at":"2022-11-10T11:49:26.336Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/niftylettuce/packages"},{"uuid":"titanism","login":"titanism","name":null,"email":"npm@titanism.com","url":null,"packages_count":282,"html_url":"https://www.npmjs.com/~titanism","role":null,"created_at":"2022-11-10T11:49:26.356Z","updated_at":"2022-11-10T11:49:26.356Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/titanism/packages"},{"uuid":"mikeal","login":"mikeal","name":null,"email":"mikeal.rogers@gmail.com","url":null,"packages_count":260,"html_url":"https://www.npmjs.com/~mikeal","role":null,"created_at":"2022-11-10T11:49:26.330Z","updated_at":"2022-11-10T11:49:26.330Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/mikeal/packages"},{"uuid":"alexindigo","login":"alexindigo","name":null,"email":"iam@alexindigo.com","url":null,"packages_count":57,"html_url":"https://www.npmjs.com/~alexindigo","role":null,"created_at":"2022-11-10T11:49:26.341Z","updated_at":"2022-11-10T11:49:26.341Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/alexindigo/packages"}]}