# CVE-2026-56812: Phoenix Framework DoS in Presence JavaScript client

Source: https://junglewise.ai/threats/cve-2026-56812-phoenix-framework-dos-in-presence-javascript-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56812 · Severity: medium · CVSS 4 · Published 2026-07-07

Phoenix is a popular web framework for Elixir that includes a JavaScript library for tracking user presence in real-time channels. An authenticated attacker can join a presence channel and select a username matching a built-in JavaScript object property (such as `__proto__` or `constructor`). This causes all viewers of that channel to receive malformed presence updates, triggering an uncaught error that breaks presence synchronization for every connected user until the attacker leaves.

Vendors: [Hex](https://junglewise.ai/threats/vendors/hex), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-56812 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56812 being exploited in the wild.

**How severe is CVE-2026-56812?** Medium severity, with a CVSS score of 4, published 7 July 2026.

**Which products and versions are affected?** phoenix (Hex) SEMVER:introduced=1.2.0-rc.0,fixed=1.5.15; phoenix (npm) SEMVER:introduced=1.2.0-rc.0,fixed=1.5.15; Phoenix Framework 1.2.0-rc.0 to <1.5.15, 1.6.0-rc.0 to <1.6.17, 1.7.0-rc.0 to <1.7.24, 1.8.0-rc.0 to <1.8.9; Phoenix Framework Project Phoenix 1.2.0 to 1.5.14, 1.6.0 to 1.6.16, 1.7.0 to 1.7.23, 1.8.0 to 1.8.8.

**Is there a fix for CVE-2026-56812?** Yes. phoenix (Hex): upgrade to 1.5.15 or later; phoenix (npm): upgrade to 1.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56812 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56812?** Check whether you run phoenix (Hex), phoenix (npm), Phoenix Framework or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phoenix (Hex): upgrade to 1.5.15 or later
- phoenix (npm): upgrade to 1.5.15 or later

  ```sh
  npm install phoenix@1.5.15
  ```


## Technical details

The vulnerability is a prototype member collision in the presence state synchronization logic. The `Presence.syncState()` and `Presence.syncDiff()` methods in `assets/js/phoenix/presence.js` use a bare `state[key]` truthiness check to determine if a presence already exists locally. When `state` is a plain JavaScript object inheriting from `Object.prototype`, accessing `state["__proto__"]` returns the truthy `Object.prototype` object rather than `undefined`. The code then attempts `currentPresence.metas.map(m => m.phx_ref)`, which fails with a `TypeError` because `Object.prototype.metas` is `undefined`. Phoenix's channel callbacks lack try/catch wrapping, so the error propagates uncaught, preventing state updates and blocking `onSync()` callbacks. The malicious key is re-pushed on every server presence update, keeping the error active until the attacker leaves. The fix uses `Object.create(null)` to create state objects without prototype chains, or employs `Object.prototype.hasOwnProperty.call()` for existence checks. The impact is scoped per channel topic and does not mutate `Object.prototype` across channels. Affected applications must pass client-controlled keys to `Presence.track()` to be vulnerable.

## Affected products

- Phoenix phoenix >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9
- Phoenix phoenix (npm) >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9

## Identifiers

- CVE-2026-56812
- EEF-CVE-2026-56812
- GHSA-63mc-hw7g-86rr

## Timeline

- 2026-07-07: disclosed: Published to NVD
- 2026-09-03: advisory: Published to GitHub Advisory Database and reviewed
- 2026-09-03: patched: Patched versions available: 1.5.15, 1.6.17, 1.7.24, 1.8.9

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [Phoenix Framework denial of service via unbounded channel joins in Phoenix.Socket](https://junglewise.ai/threats/cve-2026-56811-phoenix-framework-denial-of-service-via-unbounded-channel-joins)