CVE-2026-54892: Plug Package Suffers from Quadratic-Time Decoding Vulnerability Leading to Denial of Service
Summary
CVE-2026-54892: Plug: quadratic-time decoding of nested query/body parameters enables denial of service. Affects plug across 10 version ranges.
>= 1.15.0, < 1.15.5
>= 1.16.0, < 1.16.4
>= 1.17.0, < 1.17.2
>= 1.18.0, < 1.18.3
>= 1.19.0, < 1.19.3
< 9c5d37c440eaae92869eed7c014c47266744fadb
>= 712b875d3442c765d8d37e546ffd5ad9f8afcc55, < c317d08fdcf96e17931f7419275b2b8c4bf3e951
< a61124aa625d819a218fb07f90afbac8aa85eb0e
< d4e5568392a4b29e545b91e12e87d6098f976145
< d737eb236f17e31a36290e39f9ef3cd86a1343bd
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plug is a specification and set of utilities for building web applications in Elixir. It provides a modular approach to handling HTTP requests and responses, enabling developers to create scalable and maintainable applications. The package is widely used in the Elixir ecosystem, particularly in conjunction with the Phoenix framework. However, it has been found to have a vulnerability that can be exploited to cause denial of service, affecting the performance and availability of applications that rely on it.
Vulnerability Detail
The vulnerability arises from an inefficient algorithmic complexity in Plug's nested-parameter decoder. Specifically, the decoding process for query strings and application/x-www-form-urlencoded request bodies can be exploited by an unauthenticated remote attacker. When a key contains many bracketed segments, such as 'a[a][a]=1', the decoder performs a map operation for each level of nesting, leading to quadratic time complexity. This means that as the number of nesting levels increases, the time taken to decode the request grows exponentially. With the default body limit of 1,000,000 bytes, an attacker can craft a request with approximately 333,000 nesting levels, which can saturate the BEAM scheduler for extended periods, rendering the server unresponsive. This vulnerability does not require any authentication or knowledge of application routes, making it particularly dangerous.
How To Fix
Latest published version: 1.20.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.15.0, < 1.15.51.15.5 -
>= 1.16.0, < 1.16.41.16.4 -
>= 1.17.0, < 1.17.21.17.2 -
>= 1.18.0, < 1.18.31.18.3 -
>= 1.19.0, < 1.19.31.19.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the nesting levels in your application by implementing a custom parser or by validating the request parameters before processing them. This can help mitigate the risk of denial of service attacks until you can update to a patched version.
Conclusion
CVE-2026-54892 represents a significant vulnerability in the Plug package that can lead to denial of service attacks. It is crucial for developers using affected versions to update to the latest patched versions to ensure the security and availability of their applications. Additionally, implementing workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for plug →
FAQ
CVE-2026-54892 is a vulnerability in the Plug package that allows for denial of service due to quadratic-time decoding of nested query and body parameters.
An attacker can craft a request with a large number of nested parameters, causing the server to become unresponsive due to excessive resource consumption.
The vulnerability affects Plug versions from 1.15.0 to 1.15.4, 1.16.0 to 1.16.3, 1.17.0 to 1.17.1, 1.18.0 to 1.18.2, and 1.19.0 to 1.19.2.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to test your application without any signup.
The CVSS score for CVE-2026-54892 is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for plug.
