The vulnerability arises from improper neutralization of CRLF sequences in the req library's multipart form data construction. Specifically, the encode_form_part/2 function builds per-part headers by directly inserting caller-supplied metadata (name, filename, content_type) into content-disposition and content-type header lines without sanitization. An attacker can exploit this by crafting values containing carriage return and line feed characters to prematurely close header lines and inject additional headers or multipart parts. This affects all ways of supplying parts, with particular ease when filenames come from POSIX file paths that may include CR or LF characters. The issue affects req versions from 0.5.3 up to but not including 0.6.0.

An attacker able to control multipart form part metadata can inject arbitrary headers or smuggle additional multipart fields into requests sent downstream by applications using the vulnerable req library. This can lead to request smuggling attacks or manipulation of request contents, potentially impacting downstream services that process these requests. The CVSS 4.0 score is low (2.1), indicating limited impact and exploitability, requiring local access and partial attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch link provided at this time. Until a fix is available, avoid forwarding user-controlled filenames, field names, or MIME types through Req.post/2 with form_multipart enabled. Consider sanitizing or validating these inputs to remove CR and LF characters before passing them to the req library.