CVE-2026-49756: Multipart Form-Data Header Injection in Req Package
Summary
CVE-2026-49756: Multipart form-data header injection in Req via unescaped name/filename/content_type. Affects req across 2 version ranges.
>= 0.5.3, < 0.6.0
>= 60253dbe9436cb8e9c738f895032f2e87939b597, < 74506ff2c5addf74df85d79dc726e9b2e264a8ba
Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Req package is a popular library in the Elixir ecosystem used for making HTTP requests. It simplifies the process of sending requests and handling responses, particularly for multipart form-data uploads. However, it has a vulnerability that allows attackers to manipulate multipart parameters, potentially leading to serious security issues.
Vulnerability Detail
The vulnerability stems from improper neutralization of CRLF sequences, allowing for CRLF injection in multipart headers. Specifically, the Req.Utils.encode_form_part/2 function interpolates user-supplied values directly into headers without escaping or stripping CRLF characters. This can lead to an attacker injecting arbitrary headers or smuggling additional fields into the request. The vulnerability affects versions of Req from 0.5.3 to below 0.6.0, making it a critical issue for applications that handle user-controlled filenames or metadata.
How To Fix
Minimum fixed version
0.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, sanitize any user-influenced values for name, filename, and content_type before passing them to Req.post/2. At a minimum, reject or strip any values containing '\r', '\n', or '"'. Here is an example of how to sanitize these values:
def sanitize_input(value) do
String.replace(value, ~r/[\r\n"]/, "")
end
Conclusion
CVE-2026-49756 is a significant vulnerability in the Req package that can lead to severe security risks if not addressed. It is crucial for developers using affected versions to update to the patched version or implement the suggested workarounds to mitigate the risk.
See every vulnerability recorded for req →
FAQ
CVE-2026-49756 is a vulnerability in the Req package that allows for multipart form-data header injection due to improper handling of user-supplied values.
If your application uses Req versions between 0.5.3 and below 0.6.0 and handles user-controlled filenames or metadata, it may be affected. You can check for vulnerabilities using Vulert without signup.
An attacker could inject arbitrary headers or smuggle additional fields into requests, potentially leading to data leakage or unauthorized actions on the server.
You can update the Req package by modifying your mix.exs file to specify version 0.6.0 or later and running the command: mix deps.update req.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the mix.lock file. You can check if your application is affected by vulnerabilities using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for req.
