Hex/req CVE-2026-49756: low 3.7, EPSS 0.21%
Multipart form-data header injection in Req via unescaped name/filename/content_type
Action: Upgrade req to 0.6.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.3 | 0.6.0 | - |
Fixed versions
| 0.6.0 |
Sources
- osv: EEF-CVE-2026-49756
- nvd: CVE-2026-49756
- https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m
- https://cna.erlef.org/cves/CVE-2026-49756.html
- https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba
- https://hex.pm/packages/req
CVE-2026-49756 · published · modified · JSON