{"action":"Upgrade plug to 1.15.5 (1.15.x), 1.16.4 (1.16.x), 1.17.2 (1.17.x), 1.18.3 (1.18.x) or 1.19.3 (1.19.x) or later.","affected":[{"fixed":"1.15.5","introduced":"1.15.0"},{"fixed":"1.16.4","introduced":"1.16.0"},{"fixed":"1.17.2","introduced":"1.17.0"},{"fixed":"1.18.3","introduced":"1.18.0"},{"fixed":"1.19.3","introduced":"1.19.0"}],"component":"plug","cve_ids":["CVE-2026-54892"],"ecosystem":"Hex","epss":0.00894,"exploited":false,"fixed_versions":["1.15.5","1.16.4","1.17.2","1.18.3","1.19.3"],"ghsa_id":"GHSA-j43x-5hjq-rgxf","id":"tcs_01M5N86XRC000SGDB447SAEPEF","modified_at":"2026-09-23T14:15:04.788541968Z","published_at":"2026-09-23T14:00:22Z","references":["https://osv.dev/vulnerability/GHSA-j43x-5hjq-rgxf","https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf","https://nvd.nist.gov/vuln/detail/CVE-2026-54892","https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb","https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e","https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951","https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145","https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd","https://cna.erlef.org/cves/CVE-2026-54892.html","https://github.com/elixir-plug/plug","https://github.com/elixir-plug/plug/blob/v1.19.3/CHANGELOG.md#v1193-2026-06-23","https://osv.dev/vulnerability/EEF-CVE-2026-54892"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-j43x-5hjq-rgxf","url":"https://osv.dev/vulnerability/GHSA-j43x-5hjq-rgxf"},{"source":"nvd","source_id":"CVE-2026-54892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54892"}],"summary":"Plug: quadratic-time decoding of nested query/body parameters enables denial of service"}