Repository navigation
Update hackney dependency to 4.x to fix CVE-2026-47075 and CVE-2026-47066 #149
Description
Activity
@achempion do you have updates on this one ? impact is huge for applications using waffle.
@klacointe do you have any feelings about #156 ? Like several others I tried my hand at a finch adapter, and I found myself re-implementing several req features... poorly.
@klacointe do you have any feelings about #156 ? Like several others I tried my hand at a finch adapter, and I found myself re-implementing several req features... poorly.
It seems to do the job (even I didn't test IRL):
- no breaking changes -
hackneyis still the defaulthttp_clientand remains in dependencies reqis popular
It's ok for me.
Next step is to remove the hackney dependencie.
- no breaking changes -
@achempion do you have updates on this one ? impact is huge for applications using waffle.
#156 looking good, I'll switch default adapter from hackney to req soon
Reacted by klacointe, hendrix-7, Jim Kane and Julien
Security vulnerabilities in hackney dependency
The current hackney constraint (
~> 1.9) pins waffle to the 1.x line, which is affected by two high-severity CVEs:CVE-2026-47075 allows an attacker who controls any part of the URL passed to hackney to inject raw CRLF sequences into the request target, enabling arbitrary HTTP header injection or request splitting.
Proposed fix
Bump the hackney constraint to
~> 4.0inmix.exs, and upgradeex_awsto>= 2.7.0(the first version to declarehackney ~> 4.0). The existing~> 2.1constraint in waffle already allows this.Breaking changes — waffle code changes required
This is not a drop-in bump. hackney 3.0.0 introduced breaking API changes that affect
lib/waffle/http_client/hackney.exdirectly:Response format change
Removed functions
hackney:body/1hackney:body/2hackney:stream_body/1[async]or[{async, once}]Waffle currently calls
:hackney.get/4and then:hackney.body(client_ref, max_body_length)— both the pattern match on the response and the body call will need updating.See the official hackney Migration Guide for full details.