Executive brief
Req, a popular HTTP client for the Elixir programming language, is vulnerable to a header injection flaw when sending multipart form data (often used for file uploads). If an application allows users to influence file names or content types, an attacker could manipulate the outgoing request to inject malicious headers or smuggle additional data. This could lead to unauthorized data modification or bypass security filters in downstream services that receive these requests.
Technical details
The vulnerability exists in `Req.Utils.encode_form_part/2` within `lib/req/utils.ex`, which builds multipart headers by concatenating caller-supplied strings verbatim. Because the library does not perform CRLF stripping or quote escaping for the `name`, `filename`, and `content_type` fields, an attacker can inject `\r\n` sequences to terminate the current header and start new ones. This allows for HTTP request smuggling and multipart parameter smuggling. The flaw is particularly accessible when using `%File.Stream{}`, as POSIX filenames containing newlines are not properly sanitized before being used in the `Content-Disposition` header. The issue is fixed in version 0.6.0 by implementing percent-encoding as per RFC 7578.
Affected products
- wojtekmach req >= 0.5.3, < 0.6.0
Timeline
- 2026-06-08: disclosed
- 2026-06-08: patched: Version 0.6.0 released
- 2026-07-29: advisory