req (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.6.1 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:req, "~> 0.6.1"} # then: mix deps.update req

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-49755 Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies	High EPSS 0.60%	`>= 0.1.0, < 0.6.1`	`0.6.1`
EEF-CVE-2026-49755 Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies	High EPSS 0.60%	`>= 0.1.0, < 0.6.1`	`0.6.1`
GHSA-px9f-whj3-246m Multipart form-data header injection in Req via unescaped name/filename/content_type	Low EPSS 0.21%	`>= 0.5.3, < 0.6.0`	`0.6.0`
GHSA-px9f-whj3-246m Multipart form-data header injection in Req via unescaped name/filename/content_type	Low EPSS 0.21%	`>= 0.5.3, < 0.6.0`	`0.6.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor