CVE-2026-105963

Name of the Vulnerable Software and Affected Versions plug versions 1.6.3 through 1.6.9 plug crypto versions 1.0.0 through 2.2.0

Description An unauthenticated remote attacker can expose the secret key base or other sensitive secrets through application logs by providing wrong-typed arguments. This occurs because public functions in Plug.Crypto use function-head guards for argument validation. When a guard fails, the Erlang VM raises a FunctionClauseError that includes the actual argument values in the top stack frame. Since the library's rescue blocks and the Plug.Crypto.prune args from stacktrace/1 function only handle exceptions raised within a function body, they do not catch guard failures. Consequently, Plug.Cowboy and Bandit write this frame to the error log and attach it as crash reason metadata, which may be forwarded to error trackers.

Two primary entry points are affected:

Accessing the leaked information requires separate access to the application logs or the error tracker.

Recommendations Update plug to version 1.7.0 or later. Update plug crypto to version 2.2.1 or later. As a temporary workaround, validate that arguments are binaries before passing them to Phoenix.Token.verify/4, Phoenix.Token.decrypt/4, Plug.Crypto.verify/4, Plug.Crypto.decrypt/4, or Plug.Crypto.secure compare/2. Configure error trackers to drop stack-frame arguments to prevent secrets from being forwarded in crash reports.