—Hex
EEF-CVE-2026-49755· CVE-2026-49755, GHSA-655f-mp8p-96gvDecompression bomb DoS in Req via auto-decoded archive and compressed response bodies
Modified: 9/8/2026
package
Hex/req
pkg:hex/req
—Hex
EEF-CVE-2026-49756· CVE-2026-49756, GHSA-px9f-whj3-246mMultipart form-data header injection in Req via unescaped name/filename/content_type
Modified: 9/8/2026
HIGHHex
GHSA-655f-mp8p-96gv· CVE-2026-49755, EEF-CVE-2026-49755Req vulnerable to unbounded archive/compression extraction triggered by response content-type
Modified: 7/29/2026
MEDIUMHex
GHSA-px9f-whj3-246m· CVE-2026-49756, EEF-CVE-2026-49756Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type
Modified: 7/29/2026