chore(deps): update [mix] plug (1.19.2 → 1.19.5) [security] - autoclosed

[wttj-bot]

This PR contains the following updates:

Package	Type	Update	Change
plug (source)	prod	patch	1.19.2 → 1.19.5

---

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

CVE-2026-54892 / EEF-CVE-2026-54892 / GHSA-j43x-5hjq-rgxf

More information

Details

Summary

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels.

With the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required.

This vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2.

This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf
• https://cna.erlef.org/cves/CVE-2026-54892.html
• https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951
• https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb
• https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd
• https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145
• https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e
• https://hex.pm/packages/plug

This data is provided by OSV.

---

Cookie attribute injection in Plug.Conn.Cookies.encode/2

CVE-2026-56813 / EEF-CVE-2026-56813 / GHSA-wpmj-jh88-rpgm

More information

Details

Summary

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.

The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.

An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.

This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.

Workaround

Validate or reject the ';' delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

• https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm
• https://cna.erlef.org/cves/CVE-2026-56813.html
• https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c
• https://hex.pm/packages/plug

This data is provided by OSV.

---

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

CVE-2026-56814 / EEF-CVE-2026-56814 / GHSA-95qv-c9g9-rm63

More information

Details

Summary

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.

Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.

This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.

This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63
• https://cna.erlef.org/cves/CVE-2026-56814.html
• https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6
• https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e
• https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f
• https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364
• https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc
• https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56
• https://hex.pm/packages/plug

This data is provided by OSV.

---

Release Notes

elixir-plug/plug (plug)

v1.19.5

Compare Source

Security

• [Plug.Parsers.MULTIPART] Count files and skipped multipart parts towards the length limit (CVE-2026-56814)
• [Plug.Conn.Cookies] Raise if ; is present in cookie attributes (CVE-2026-56813)

v1.19.4

Compare Source

Bug fixes

• [Plug.Conn] Allow atom header keys on inform

v1.19.3

Compare Source

Security

• [Plug.Conn.Query] Force a maximum depth when decoding queries (CVE-2026-54892)

Bug fixes

• [Plug.Conn] Validate headers on inform
• [Plug.Static] Enforce size on range requests

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.