@@ -15,6 +15,18 @@ var setToStringTag = require('es-set-tostringtag');
 var hasOwn = require('hasown');
 var populate = require('./populate.js');
 
+/**
+ * Escape CR, LF, and `"` in a multipart `name`/`filename` parameter, so a field
+ * name or filename can not break out of its header line to inject headers or
+ * smuggle additional parts. Matches the WHATWG HTML multipart/form-data encoding.
+ *
+ * @param {string} str - the parameter value to escape
+ * @returns {string} the escaped value
+ */
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -180,7 +192,7 @@ FormData.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || [])
   };
@@ -234,7 +246,7 @@ FormData.prototype._getContentDisposition = function (value, options) { // eslin
   }
 
   if (filename) {
-    return 'filename="' + filename + '"';
+    return 'filename="' + escapeHeaderParam(filename) + '"';
   }
 };
 
 
@@ -0,0 +1,51 @@
+'use strict';
+
+var common = require('../common');
+var assert = common.assert;
+
+var FormData = require(common.dir.lib + '/form_data');
+
+(function testFieldNameCRLFInjection() {
+  var form = new FormData();
+  form.append('email"\r\nX-Injected: true\r\nfake="', 'user@example.com');
+
+  var output = form.getBuffer().toString();
+
+  assert.equal(output.indexOf('X-Injected: true\r\n'), -1, 'CRLF in a field name must not produce an injected header line');
+  assert.notEqual(output.indexOf('%0D%0A'), -1, 'CR/LF in a field name must be escaped');
+  assert.notEqual(output.indexOf('%22'), -1, 'a `"` in a field name must be escaped');
+}());
+
+(function testFilenameCRLFInjection() {
+  var form = new FormData();
+  form.append('file', Buffer.from('x'), { filename: 'a"\r\nX-Injected: yes\r\nb"' });
+
+  var output = form.getBuffer().toString();
+
+  assert.equal(output.indexOf('X-Injected: yes\r\n'), -1, 'CRLF in a filename must not produce an injected header line');
+  assert.notEqual(output.indexOf('filename="a%22%0D%0A'), -1, 'CR/LF/`"` in a filename must be escaped');
+}());
+
+(function testFieldNameBoundarySmuggling() {
+  var form = new FormData();
+  var boundary = form.getBoundary();
+
+  form.append('username"\r\n\r\nlegit_user\r\n--' + boundary + '\r\nContent-Disposition: form-data; name="is_admin"\r\n\r\ntrue\r\n--' + boundary + '\r\nContent-Disposition: form-data; name="fake', 'ignored_value');
+
+  var output = form.getBuffer().toString();
+  var headerLines = output.split('\r\n').filter(function (line) {
+    return line.indexOf('Content-Disposition') === 0;
+  });
+
+  assert.equal(output.indexOf('name="is_admin"'), -1, 'a CRLF-laden field name must not smuggle an extra part');
+  assert.equal(headerLines.length, 1, 'the whole field name must stay on one header line, smuggling no extra parts');
+}());
+
+(function testOrdinaryFieldNamePreserved() {
+  var form = new FormData();
+  form.append('items[0]', 'value');
+
+  var output = form.getBuffer().toString();
+
+  assert.notEqual(output.indexOf('name="items[0]"'), -1, 'a field name without control characters must be unchanged');
+}());