highPublished September 23, 2026

Plug (Elixir): one crafted form or query string can freeze a Phoenix server

Identifiers: CVE-2026-54892 · GHSA-j43x-5hjq-rgxf · EEF-CVE-2026-54892 · CVSS 4.0 8.7 (scored by EEF)

What it is

Plug decodes nested parameters such as a[a][a]…=1 in time that grows with the square of the nesting depth. A single small request to any endpoint (query string, form post or multipart upload) keeps a CPU core busy for minutes, and a few of them make the app stop answering. No login is needed.

Who is affected

Versions inside these ranges are affected. The fixed versions are the ones to move to.

Registry	Package	Affected	Move to
Hex	plug	>= 1.15.0, < 1.15.5 >= 1.16.0, < 1.16.4 >= 1.17.0, < 1.17.2 >= 1.18.0, < 1.18.3 >= 1.19.0, < 1.19.3	1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3

How to check

Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:

Linux (x86_64 or arm64), WSL and CI runners

d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps

macOS or Windows, with Docker

docker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'

Already have the CLI?

xsec deps

Or look up plug in your lockfile and compare the version with the ranges above.

How to fix it

Upgrade plug to 1.15.5, 1.16.4, 1.17.2, 1.18.3 or 1.19.3 or later, matching your line (mix deps.update plug, then commit mix.lock). Until then lower the body limits in Plug.Parsers and have your proxy cap the query string's length.

Sources

This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.