Read the docs
TI-2026-40965 Aliases CVE-2026-56812GHSA-63mc-hw7g-86rr

Improper check for unusual conditions in phoenixframework phoenix

Priority MEDIUM 61CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff. The Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError. The exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution). This issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00796 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed phoenix (phoenixframework): 1.5.15, 1.6.17, 1.7.24 +1phoenix (Hex): 1.5.15, 1.6.17, 1.7.24 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
phoenixframeworkphoenix1.2.0-rc.0 to before 1.5.15; 1.6.0-rc.0 to before 1.6.17; 1.7.0-rc.0 to before 1.7.24; 1.8.0-rc.0 to before 1.8.91.5.15, 1.6.17, 1.7.24, 1.8.9Patch availableCNA
phoenixframeworkphoenix1.2.0-rc.0 to before 1.5.15; 1.6.0-rc.0 to before 1.6.17; 1.7.0-rc.0 to before 1.7.24; 1.8.0-rc.0 to before 1.8.91.5.15, 1.6.17, 1.7.24, 1.8.9Patch availableCNA
—phoenix (Hex)1.2.0-rc.0 to before 1.5.151.5.15Patch availableGHSA-63mc-hw7g-86rr
—phoenix (Hex)1.6.0-rc.0 to before 1.6.171.6.17Patch availableGHSA-63mc-hw7g-86rr
—phoenix (Hex)1.7.0-rc.0 to before 1.7.241.7.24Patch availableGHSA-63mc-hw7g-86rr
—phoenix (Hex)1.8.0-rc.0 to before 1.8.91.8.9Patch availableGHSA-63mc-hw7g-86rr
—phoenix (npm)1.2.0-rc.0 to before 1.5.151.5.15Patch availableGHSA-63mc-hw7g-86rr
—phoenix (npm)1.6.0-rc.0 to before 1.6.171.6.17Patch availableGHSA-63mc-hw7g-86rr
—phoenix (npm)1.7.0-rc.0 to before 1.7.241.7.24Patch availableGHSA-63mc-hw7g-86rr
—phoenix (npm)1.8.0-rc.0 to before 1.8.91.8.9Patch availableGHSA-63mc-hw7g-86rr
  • phoenix Vendorphoenixframework Affected 1.2.0-rc.0 to before 1.5.15; 1.6.0-rc.0 to before 1.6.17; 1.7.0-rc.0 to before 1.7.24; 1.8.0-rc.0 to before 1.8.9 Fixed in 1.5.15, 1.6.17, 1.7.24, 1.8.9 Patch available CNA
  • phoenix Vendorphoenixframework Affected 1.2.0-rc.0 to before 1.5.15; 1.6.0-rc.0 to before 1.6.17; 1.7.0-rc.0 to before 1.7.24; 1.8.0-rc.0 to before 1.8.9 Fixed in 1.5.15, 1.6.17, 1.7.24, 1.8.9 Patch available CNA
  • phoenix (Hex) Vendor— Affected 1.2.0-rc.0 to before 1.5.15 Fixed in 1.5.15 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (Hex) Vendor— Affected 1.6.0-rc.0 to before 1.6.17 Fixed in 1.6.17 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (Hex) Vendor— Affected 1.7.0-rc.0 to before 1.7.24 Fixed in 1.7.24 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (Hex) Vendor— Affected 1.8.0-rc.0 to before 1.8.9 Fixed in 1.8.9 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (npm) Vendor— Affected 1.2.0-rc.0 to before 1.5.15 Fixed in 1.5.15 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (npm) Vendor— Affected 1.6.0-rc.0 to before 1.6.17 Fixed in 1.6.17 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (npm) Vendor— Affected 1.7.0-rc.0 to before 1.7.24 Fixed in 1.7.24 Patch available GHSA-63mc-hw7g-86rr
  • phoenix (npm) Vendor— Affected 1.8.0-rc.0 to before 1.8.9 Fixed in 1.8.9 Patch available GHSA-63mc-hw7g-86rr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*1.2.0 to before 1.5.15; 1.6.0 to before 1.6.17; 1.7.0 to before 1.7.24; 1.8.0 to before 1.8.9Vulnerablephoenixframework
  • cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.5.15; 1.6.0 to before 1.6.17; 1.7.0 to before 1.7.24; 1.8.0 to before 1.8.9 Vulnerable ·phoenixframework

Remediation

  • Fix · CNA phoenix (phoenixframework) Fixed in 1.5.15, 1.6.17, 1.7.24, 1.8.9
  • Fix · CNA phoenix (phoenixframework) Fixed in 1.5.15, 1.6.17, 1.7.24, 1.8.9
  • Fix · GHSA-63mc-hw7g-86rr phoenix (Hex) Fixed in 1.5.15 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (Hex) Fixed in 1.6.17 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (Hex) Fixed in 1.7.24 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (Hex) Fixed in 1.8.9 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (npm) Fixed in 1.5.15 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (npm) Fixed in 1.6.17 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (npm) Fixed in 1.7.24 Advisory →
  • Fix · GHSA-63mc-hw7g-86rr phoenix (npm) Fixed in 1.8.9 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    phoenixframework phoenix 1.5.15, 1.6.17 and 2 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-40964 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of servicePriority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56812
  2. 2026-10-03 Alias added: GHSA-63mc-hw7g-86rr

References

Exploit 1

Patch 5

Advisory 2

Other 2

  • TI-2026-40964 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service CVSS 4.0HIGH 8.7
  • TI-2022-20955 socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. CVSS 3.1HIGH 7.5
  • TI-2017-14495 The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences