CVE-2026-56812: Phoenix Framework DoS in Presence JavaScript client

CVE-2026-56812 · Severity: medium · CVSS 4 · Published 2026-07-07

Phoenix is a popular web framework for Elixir that includes a JavaScript library for tracking user presence in real-time channels. An authenticated attacker can join a presence channel and select a username matching a built-in JavaScript object property (such as `__proto__` or `constructor`). This causes all viewers of that channel to receive malformed presence updates, triggering an uncaught error that breaks presence synchronization for every connected user until the attacker leaves.

Vendors: Hex, npm.

Quick answers

Is CVE-2026-56812 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56812 being exploited in the wild.
How severe is CVE-2026-56812?
Medium severity, with a CVSS score of 4, published 7 July 2026.
Which products and versions are affected?
phoenix (Hex) SEMVER:introduced=1.2.0-rc.0,fixed=1.5.15; phoenix (npm) SEMVER:introduced=1.2.0-rc.0,fixed=1.5.15; Phoenix Framework 1.2.0-rc.0 to <1.5.15, 1.6.0-rc.0 to <1.6.17, 1.7.0-rc.0 to <1.7.24, 1.8.0-rc.0 to <1.8.9; Phoenix Framework Project Phoenix 1.2.0 to 1.5.14, 1.6.0 to 1.6.16, 1.7.0 to 1.7.23, 1.8.0 to 1.8.8.
Is there a fix for CVE-2026-56812?
Yes. phoenix (Hex): upgrade to 1.5.15 or later; phoenix (npm): upgrade to 1.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56812 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56812?
Check whether you run phoenix (Hex), phoenix (npm), Phoenix Framework or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phoenix (Hex): upgrade to 1.5.15 or later
  • phoenix (npm): upgrade to 1.5.15 or later
    npm install phoenix@1.5.15

Technical details

The vulnerability is a prototype member collision in the presence state synchronization logic. The `Presence.syncState()` and `Presence.syncDiff()` methods in `assets/js/phoenix/presence.js` use a bare `state[key]` truthiness check to determine if a presence already exists locally. When `state` is a plain JavaScript object inheriting from `Object.prototype`, accessing `state["__proto__"]` returns the truthy `Object.prototype` object rather than `undefined`. The code then attempts `currentPresence.metas.map(m => m.phx_ref)`, which fails with a `TypeError` because `Object.prototype.metas` is `undefined`. Phoenix's channel callbacks lack try/catch wrapping, so the error propagates uncaught, preventing state updates and blocking `onSync()` callbacks. The malicious key is re-pushed on every server presence update, keeping the error active until the attacker leaves. The fix uses `Object.create(null)` to create state objects without prototype chains, or employs `Object.prototype.hasOwnProperty.call()` for existence checks. The impact is scoped per channel topic and does not mutate `Object.prototype` across channels. Affected applications must pass client-controlled keys to `Presence.track()` to be vulnerable.

Affected products

  • Phoenix phoenix >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9
  • Phoenix phoenix (npm) >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9

Identifiers

  • CVE-2026-56812
  • EEF-CVE-2026-56812
  • GHSA-63mc-hw7g-86rr

Timeline

  • 2026-07-07: disclosed: Published to NVD
  • 2026-09-03: advisory: Published to GitHub Advisory Database and reviewed
  • 2026-09-03: patched: Patched versions available: 1.5.15, 1.6.17, 1.7.24, 1.8.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.