Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-105963 · Microsoft / collected KEV context

cve-program · CVE-2026-105963

• https://github.com/elixir-plug/plug/security/advisories/GHSA-ffw9-w85g-f2vh
• https://cna.erlef.org/cves/CVE-2026-105963.html
• https://osv.dev/vulnerability/EEF-CVE-2026-105963
• https://github.com/elixir-plug/plug/commit/56000c33d8a0a2fbac491f8be06b9c5112bc2276
• https://github.com/elixir-plug/plug/commit/aeaa90e76b73ea90c3ecca9aae16fce71bd2a8d4
• https://github.com/elixir-plug/plug_crypto/commit/2d078b7b8264c565f0ff71235c515f4f46882dcf
• https://github.com/elixir-plug/plug_crypto/commit/981887493dada0fce7003c61861c00dfbb0fc8c5

• Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments · Newly collected advisory · 23 Oct 2026