plug (Hex)
Advisories
27
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.20.3 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:plug, "~> 1.20.3"} # then: mix deps.update plugKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments |
Not rated yet EPSS 0.51% |
>= 1.6.3, < 1.7.0 | 1.7.0 |
| EEF-CVE-2026-56813 Cookie attribute injection in Plug.Conn.Cookies.encode/2 |
Not rated yet EPSS 0.22% |
>= 0.1.0, < 1.16.6>= 1.17.0, < 1.17.4>= 1.18.0, < 1.18.5>= 1.19.1, < 1.19.5>= 1.20.0, < 1.20.3 | 1.16.61.17.41.18.51.19.51.20.3 |
| EEF-CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) |
Not rated yet EPSS 1.08% |
>= 1.4.0-rc.0, < 1.16.6>= 1.17.0, < 1.17.4>= 1.18.0, < 1.18.5>= 1.19.1, < 1.19.5>= 1.20.0, < 1.20.3 | 1.16.61.17.41.18.51.19.51.20.3 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.18.0, < 1.18.3 | 1.18.3 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.19.0, < 1.19.3 | 1.19.3 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.15.0, < 1.15.5>= 1.16.0, < 1.16.4>= 1.17.0, < 1.17.2>= 1.18.0, < 1.18.3>= 1.19.0, < 1.19.3 | 1.15.51.16.41.17.21.18.31.19.3 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.15.0, < 1.15.5 | 1.15.5 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.16.0, < 1.16.4 | 1.16.4 |
| EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
High EPSS 0.89% |
>= 1.17.0, < 1.17.2 | 1.17.2 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.16.0, < 1.16.3 | 1.16.3 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.19.0, < 1.19.2 | 1.19.2 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.18.0, < 1.18.2 | 1.18.2 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.17.0, < 1.17.1 | 1.17.1 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.4.0, < 1.15.4>= 1.16.0, < 1.16.3>= 1.17.0, < 1.17.1>= 1.18.0, < 1.18.2>= 1.19.0, < 1.19.2 | 1.15.41.16.31.17.11.18.21.19.2 |
| EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug |
High EPSS 0.62% |
>= 1.4.0, < 1.15.4 | 1.15.4 |
| GHSA-9h73-w7ch-rh73 Header Injection |
Medium EPSS 1.13% |
>= 1.3.0, < 1.3.5 | 1.3.5 |
| GHSA-9h73-w7ch-rh73 Header Injection |
Medium EPSS 1.13% |
< 1.0.6 | 1.0.6 |
| GHSA-9h73-w7ch-rh73 Header Injection |
Medium EPSS 1.13% |
>= 1.1.0, < 1.1.9 | 1.1.9 |
| GHSA-9h73-w7ch-rh73 Header Injection |
Medium EPSS 1.13% |
>= 1.2.0, < 1.2.5 | 1.2.5 |
| GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization |
High EPSS 1.93% |
< 1.0.4 | 1.0.4 |
| GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization |
High EPSS 1.93% |
>= 1.3.0, < 1.3.2 | 1.3.2 |
| GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization |
High EPSS 1.93% |
>= 1.2.0, < 1.2.3 | 1.2.3 |
| GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization |
High EPSS 1.93% |
>= 1.1.0, < 1.1.7 | 1.1.7 |
| GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static |
High EPSS 0.42% |
< 1.0.4 | 1.0.4 |
| GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static |
High EPSS 0.42% |
>= 1.3.0, < 1.3.2 | 1.3.2 |
| GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static |
High EPSS 0.42% |
>= 1.1.0, < 1.1.7 | 1.1.7 |
| GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static |
High EPSS 0.42% |
>= 1.2.0, < 1.2.3 | 1.2.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor