Sensitive Information Exposure in Elixir Plug's Crypto Library

CVE-2026-105963

What is CVE-2026-105963?

The Plug.Crypto library in Elixir is vulnerable to information disclosure due to improperly handled argument types in its public functions. When a wrong-typed argument is passed, the Erlang VM raises a FunctionClauseError, inadvertently exposing sensitive data such as the secret key base in the application’s logs. The error logs write out the full stack trace, which can be accessed by an unauthorized user if they have access to the logging system. This vulnerability could allow remote attackers to compromise the integrity of applications using vulnerable versions of plug and plug_crypto. Affected versions are plug from 1.6.3 to below 1.7.0 and plug_crypto from 1.0.0 to below 2.2.1.

References