CVE-2026-43971: cowlib Package Vulnerability - Link Header Directive Smuggling

Background

cowlib is a library used in Erlang applications for handling HTTP link headers. It provides functionality for creating and parsing Link headers, which are crucial for optimizing web performance through preloading resources. However, versions from 2.9.0 onward are susceptible to a serious vulnerability that allows attackers to manipulate Link headers, potentially leading to unauthorized access or data exfiltration.

Vulnerability Detail

The vulnerability arises from improper encoding or escaping of output in the cow_link:link/1 function. This function directly interpolates user-supplied values into the serialized Link header without adequate validation or escaping. An attacker can exploit this by injecting special characters into the target URI, rel value, or attribute keys, allowing them to craft malicious Link headers. This can lead to browsers making out-of-band connections to attacker-controlled origins, posing significant security risks.

Workaround

As a temporary workaround, sanitize all values before passing them to cow_link:link/1. Specifically, reject or strip any target value containing '>', any rel value containing '"' or '', and any attribute key containing characters outside the HTTP token grammar. Here is a sample code snippet for sanitization:

function sanitize_input(target, rel, attributes) {
    if (target.includes('>') || rel.includes('"') || rel.includes('\')) {
        throw new Error('Invalid input detected');
    }
    for (let key of Object.keys(attributes)) {
        if (/[^\w-]/.test(key)) {
            throw new Error('Invalid attribute key detected');
        }
    }
    return { target, rel, attributes };
}

Conclusion

CVE-2026-43971 represents a significant security risk for applications using the cowlib package. It is crucial to update to the latest version or implement the recommended workarounds to protect against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.

See every vulnerability recorded for cowlib →

FAQ