From 3593d452114c05414634f80cae496dc3a3d9da8a Mon Sep 17 00:00:00 2001
From: Chai Bot <chai-bot@redhat.com>
Date: Tue, 1 Sep 2026 21:55:57 +0000
Subject: [PATCH] AAP-87504 - fix(deps): override form-data to >=4.0.6 for
 CVE-2026-12143

CRLF injection in the form-data npm package (through v4.0.5) allows
arbitrary header injection via unescaped CR/LF/double-quote characters
in field names and filenames passed to FormData#append.

form-data is a transitive dependency via axios. Adding an npm override
to force resolution to the fixed version 4.0.6.

Ref: https://access.redhat.com/security/cve/CVE-2026-12143
---
 package-lock.json | 16 ++++++++--------
 package.json      |  1 +
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b26da02fd..500b69cd6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11367,16 +11367,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -12448,9 +12448,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
diff --git a/package.json b/package.json
index c14e7cddf..479c5e9fb 100644
--- a/package.json
+++ b/package.json
@@ -86,6 +86,7 @@
   "overrides": {
     "axios": "1.16.1",
     "follow-redirects": ">=1.16.0",
+    "form-data": ">=4.0.6",
     "query-string": {
       "decode-uri-component": "0.5.0"
     },