CVE-2026-49756

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+  * [`encode_body`]: Security fix for `:form_multipart` header injection
+    ([GHSA-px9f-whj3-246m](https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m)).
+
+    The multipart encoder interpolated the per-part `name`, `filename`, and
+    `content_type` into the part headers without escaping, so an
+    attacker-controlled value could inject extra headers or smuggle additional
+    parts into the request. These values are now escaped per RFC 7578 / WHATWG
+    form-data (`"`, CR, and LF are percent-encoded).
+
+    Thanks to @PJUllrich for reporting it.
+
 ## v0.5.18 (2026-05-20)
 
   * [`run_finch`]: Allow :finch option with IPv6 URLs.

@@ -534,7 +534,7 @@ defmodule Req.Utils do
     {Stream.concat(parts1, parts2), add_sizes(size1, size2)}
   end
 
-  defp encode_form_part({name, {value, options}}, boundary) do
+  defp encode_form_part({name, {value, options}}, boundary) when is_atom(name) do
     options = Keyword.validate!(options, [:filename, :content_type, :size])
 
     {parts, parts_size, options} =
@@ -574,18 +574,19 @@ defmodule Req.Utils do
 
     params =
       if filename = options[:filename] do
-        ["; filename=\"", filename, "\""]
+        ["; filename=\"", escape_form_param(filename), "\""]
       else
         []
       end
 
     headers =
       if content_type = options[:content_type] do
-        ["content-type: ", content_type, @crlf]
+        ["content-type: ", escape_form_param(content_type), @crlf]
       else
         []
       end
 
+    name = escape_form_param(Atom.to_string(name))
     headers = ["content-disposition: form-data; name=\"#{name}\"", params, @crlf, headers]
     header = [["--", boundary, @crlf, headers, @crlf]]
 
@@ -594,10 +595,15 @@ defmodule Req.Utils do
     |> add_form_parts({[@crlf], 2})
   end
 
-  defp encode_form_part({name, value}, boundary) do
+  defp encode_form_part({name, value}, boundary) when is_atom(name) do
     encode_form_part({name, {value, []}}, boundary)
   end
 
+  # Per RFC 7578 / WHATWG form-data behavior, escape `"`, CR, and LF.
+  defp escape_form_param(value) when is_binary(value) do
+    URI.encode(value, &(&1 not in [?", ?\r, ?\n]))
+  end
+
   @doc """
   Loads .netrc file.
 

@@ -231,6 +231,28 @@ defmodule Req.UtilsTest do
              """
     end
 
+    test "escapes name, filename, and content_type to prevent header injection" do
+      %{body: body} =
+        Req.Utils.encode_form_multipart(
+          [
+            "na\"me\r\nX-Evil: 1":
+              {"value", filename: ~s(ev"il\r\n--foo\r\n), content_type: "text/plain\r\nX-Evil: 2"}
+          ],
+          boundary: "foo"
+        )
+
+      body = IO.iodata_to_binary(body)
+
+      assert body == """
+             --foo\r\n\
+             content-disposition: form-data; name=\"na%22me%0D%0AX-Evil: 1\"; filename=\"ev%22il%0D%0A--foo%0D%0A\"\r\n\
+             content-type: text/plain%0D%0AX-Evil: 2\r\n\
+             \r\n\
+             value\r\n\
+             --foo--\r\n\
+             """
+    end
+
     test "it works with size" do
       %{content_type: content_type, body: body, size: size} =
         Req.Utils.encode_form_multipart([field1: {"value", size: 5}], boundary: "foo")