Threats affecting pkg:hex/req

CVE-2026-49755 is a high-severity vulnerability in the wojtekmach Req HTTP client library affecting versions from 0.1.0 before 0.6.1. It involves improper handling of highly compressed data, allowing attacker-controlled HTTP servers to cause excessive memory consumption via decompression-bomb response bodies. The default response processing pipeline decompresses archive formats and chains multiple content-encoding decoders without limiting decompressed size, enabling a small response to expand to multiple gigabytes and crash the BEAM process.

CVE-2026-49756 is a CRLF injection vulnerability in the wojtekmach req library versions 0.5.3 before 0.6.0. It occurs because Req.Utils.encode_form_part/2 directly interpolates user-supplied name, filename, and content_type values into multipart headers without escaping or stripping CRLF characters. This allows an attacker to inject arbitrary headers or smuggle additional multipart fields by including CR or LF characters in these values, especially when using %File.Stream{} where filenames may contain such characters. The vulnerability enables multipart parameter smuggling in downstream requests.