1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
phoenix-7
Ecosystem: npm
Downloads: 7.14 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 4 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting phoenix-7, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-63mc-hw7g-86rr | Moderate | Phoenix: Presence keys colliding with `Object.prototype` members break existence checks### Summary The Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already exists using a bare truthiness check (`state[key]`) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, and similar) makes the lookup return the inherited `Object.prototype` object instead of `undefined`, which is truthy. The |
| GitHub (opens in a new tab) | |
| EEF-CVE-2026-56812 | Unknown | Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff## Summary Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files `assets/js/phoenix/presence.js` and program routines `Presence.syncState` and `Presence.syncDiff`. The Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (`state[key]`) instead of an own-property check. Pres |
| OSV (opens in a new tab) |
- GHSA-63mc-hw7g-86rrModeratePhoenix: Presence keys colliding with `Object.prototype` members break existence checks
>= 1.2.0-rc.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17- +2 more
Affected versions:>= 1.2.0-rc.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17>= 1.7.0-rc.0, < 1.7.24>= 1.8.0-rc.0, < 1.8.9
### Summary The Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already exists using a bare truthiness check (`state[key]`) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, and similar) makes the lookup return the inherited `Object.prototype` object instead of `undefined`, which is truthy. The
CVE: CVE-2026-56812
- EEF-CVE-2026-56812UnknownPhoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
>= 1.2.0-rc.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17- +2 more
Affected versions:>= 1.2.0-rc.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17>= 1.7.0-rc.0, < 1.7.24>= 1.8.0-rc.0, < 1.8.9
## Summary Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files `assets/js/phoenix/presence.js` and program routines `Presence.syncState` and `Presence.syncDiff`. The Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (`state[key]`) instead of an own-property check. Pres
CVE: CVE-2026-56812