From baa8915bed76d98a9ee4c8aaf19819d7471f98c4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Mon, 14 Sep 2026 23:12:45 +0000
Subject: [PATCH] perlPackages.HTMLFormFu: fix CVE-2026-19873

Assisted-by: Codex (GPT-6)
(cherry picked from commit c2c93af85319583946edd86b77dcae616c2a2bca)
---
 pkgs/top-level/perl-packages.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index cf165c7b161a..3c8a22d1f34e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16296,6 +16296,12 @@ with self;
       url = "mirror://cpan/authors/id/C/CF/CFRANKS/HTML-FormFu-2.07.tar.gz";
       hash = "sha256-Ty8Bf3qHVPu26RIGyI7RPHVqFOO+oXgYjDuXdGNm6zI=";
     };
+    patches = [
+      (fetchpatch {
+        url = "https://security.metacpan.org/patches/H/HTML-FormFu/2.08/CVE-2026-19873-r1.patch";
+        hash = "sha256-1QquxDl/NuNJe6MFbeEH49hYA8agXXeWm1Q23fOM+Nc=";
+      })
+    ];
     buildInputs = [
       CGI
       FileShareDirInstall