# What changed in form-data

> 7 changes in form-data 3 to 4 from its official release notes, upgrade guides and advisories: 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/form-data/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## form-data 4

### Security

- CR, LF, and double quotes are now escaped in field names and filenames. (2.5.6, 3.0.5, 4.0.6) — [release notes](https://github.com/form-data/form-data/blob/64190db548c0179e37206858e39f27cf513e9435/CHANGELOG.md#v406---2026-06-12), [release notes](https://github.com/form-data/form-data/blob/64190db548c0179e37206858e39f27cf513e9435/CHANGELOG.md#v305---2026-06-12), [release notes](https://github.com/form-data/form-data/blob/64190db548c0179e37206858e39f27cf513e9435/CHANGELOG.md#v256---2026-06-12), [security advisory](https://github.com/advisories/GHSA-HMW2-7CC7-3QXX)

### Fixes and other changes

- Sets Symbol.toStringTag in the proper place. (4.0.5) — [release notes](https://github.com/form-data/form-data/blob/64190db548c0179e37206858e39f27cf513e9435/CHANGELOG.md#v405---2025-11-17)

## form-data 3

### New APIs and options

- The constructor type now includes readable stream options. (3.0.0) — [release notes](https://github.com/form-data/form-data/blob/HEAD/CHANGELOG.md)

### Behavior and default changes

- The userHeaders parameter is optional in the TypeScript definitions. (3.0.0) — [release notes](https://github.com/form-data/form-data/blob/HEAD/CHANGELOG.md)

### Fixes and other changes

- Options are passed to the constructor when it is called without new. (3.0.0) — [release notes](https://github.com/form-data/form-data/blob/HEAD/CHANGELOG.md)
- Fixed the getHeaders method signatures in the TypeScript definitions. (3.0.0) — [release notes](https://github.com/form-data/form-data/blob/HEAD/CHANGELOG.md)
- Fixed a memory leak. (3.0.0) — [release notes](https://github.com/form-data/form-data/blob/HEAD/CHANGELOG.md)