{"id":"GHSA-63mc-hw7g-86rr","revision":null,"records":[{"revision":"97e4bef0f48b4465b5d7b40d520205ad","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56812","aliases":[],"title":"Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError.\n\nThe exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution).\n\nThis issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.","state":0,"publishedAt":"2026-07-07T15:22:46.933+00:00","modifiedAt":"2026-09-24T21:29:18.181+00:00","affected":[{"ecosystem":"https://repo.hex.pm","name":"phoenix","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://repo.hex.pm\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Presence\"\n                    ],\n                    \"packageName\": \"phoenix\",\n                    \"packageURL\": \"pkg:hex/phoenix\",\n                    \"product\": \"phoenix\",\n                    \"programFiles\": [\n                        \"assets/js/phoenix/presence.js\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Presence.syncState\"\n                        },\n                        {\n                            \"name\": \"Presence.syncDiff\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/phoenixframework/phoenix\",\n                    \"vendor\": \"phoenixframework\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.5.15\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.2.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.6.17\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.6.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.7.24\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.7.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.8.9\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.8.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://registry.npmjs.org","name":"phoenix","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://registry.npmjs.org\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Presence\"\n                    ],\n                    \"packageName\": \"phoenix\",\n                    \"packageURL\": \"pkg:npm/phoenix\",\n                    \"product\": \"phoenix\",\n                    \"programFiles\": [\n                        \"assets/js/phoenix/presence.js\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Presence.syncState\"\n                        },\n                        {\n                            \"name\": \"Presence.syncDiff\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/phoenixframework/phoenix\",\n                    \"vendor\": \"phoenixframework\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.5.15\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.2.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.6.17\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.6.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.7.24\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.7.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"1.8.9\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.8.0-rc.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"phoenixframework/phoenix","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"Presence\"\n                    ],\n                    \"packageName\": \"phoenixframework/phoenix\",\n                    \"packageURL\": \"pkg:github/phoenixframework/phoenix\",\n                    \"product\": \"phoenix\",\n                    \"programFiles\": [\n                        \"assets/js/phoenix/presence.js\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Presence.syncState\"\n                        },\n                        {\n                            \"name\": \"Presence.syncDiff\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/phoenixframework/phoenix\",\n                    \"vendor\": \"phoenixframework\",\n                    \"versions\": [\n                        {\n                            \"changes\": [\n                                {\n                                    \"at\": \"7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"89a1c4be161e436241e12b2378a719904b9bd96f\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"b90b22521465ece00eb5a19d5aa2b9465b209c85\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"beffc4da1e787e572121f68902c63daf4fe7d9c2\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"lessThan\": \"*\",\n                            \"status\": \"affected\",\n                            \"version\": \"2270aaf21bd02c6a6a1022820564efb605a97655\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://cna.erlef.org/cves/CVE-2026-56812.html","https://osv.dev/vulnerability/EEF-CVE-2026-56812","https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56812","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56812","identifiers":["CVE-2026-56812"]},"retained":false,"historicalAffected":[]},{"revision":"0676ae5c7cee48aca4ce78921d921661","observedAt":"2026-11-07T12:37:05.459+00:00","statement":{"source":"euvd","id":"EUVD-2026-42050","aliases":["CVE-2026-56812","GHSA-63mc-hw7g-86rr"],"title":"Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every vi…","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError.\n\nThe exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution).\n\nThis issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://cna.erlef.org/cves/CVE-2026-56812.html","https://osv.dev/vulnerability/EEF-CVE-2026-56812","https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42050","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 7, 2026, 3:22:46 PM","dateUpdated":"Sep 24, 2026, 9:29:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42050","identifiers":["EUVD-2026-42050","CVE-2026-56812","GHSA-63mc-hw7g-86rr"]},"retained":false,"historicalAffected":[]},{"revision":"8a81e749f4a7432e8000786d7c1d85ca","observedAt":"2026-10-27T15:15:18.401+00:00","statement":{"source":"nvd","id":"CVE-2026-56812","aliases":[],"title":"Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every vi…","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError.\n\nThe exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution).\n\nThis issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.","state":0,"publishedAt":"2026-07-07T16:16:40.92+00:00","modifiedAt":"2026-10-25T20:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://cna.erlef.org/cves/CVE-2026-56812.html","https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2","https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://osv.dev/vulnerability/EEF-CVE-2026-56812"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56812","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-754"],"productCriteria":["cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-07T16:16:40.920","lastModified":"2026-10-25T20:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56812","identifiers":["CVE-2026-56812"]},"retained":false,"historicalAffected":[]},{"revision":"4c39fb35185645908f5b845360be2fa4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"EEF-CVE-2026-56812","aliases":["CVE-2026-56812","GHSA-63mc-hw7g-86rr"],"title":"Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff","description":"## Summary\n\nImproper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files `assets/js/phoenix/presence.js` and program routines `Presence.syncState` and `Presence.syncDiff`.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (`state[key]`) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an `Object.prototype` member name (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, and similar) makes that lookup return JavaScript's built-in `Object.prototype` instead of `undefined`. Because the prototype is truthy, the code treats it as an existing presence and reads `.metas.map(...)` off it, which throws an uncaught `TypeError`.\n\nThe exception propagates out of the presence message handler, so the local state is never updated and `onSync()` never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both `syncState` and `syncDiff` use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of `Object.prototype` (it is not prototype pollution).\n\nThis issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.\n\n## Workarounds\n\nReject or sanitize presence keys that collide with JavaScript `Object.prototype` member names (for example `__proto__`, `constructor`, `prototype`, `toString`, `hasOwnProperty`) before calling `Phoenix.Presence.track`, or namespace every presence key with a fixed prefix so that no key can equal a prototype member name. Alternatively, derive presence keys from server-controlled, validated values instead of raw user input.\n\n## Configurations\n\nThe application must use `Phoenix.Presence` (or otherwise drive the Phoenix JavaScript presence client) and track presences under keys that are influenced by untrusted client input, for example a username or id chosen by the connecting user. Applications that derive presence keys exclusively from server-controlled, validated values are not affected.","state":0,"publishedAt":"2026-07-07T15:22:46.933+00:00","modifiedAt":"2026-09-24T21:30:06.5864706+00:00","affected":[{"ecosystem":"Hex","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0-rc.0"},{"kind":"fixed","version":"1.5.15"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0-rc.0"},{"kind":"fixed","version":"1.6.17"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0-rc.0"},{"kind":"fixed","version":"1.7.24"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.8.0-rc.0"},{"kind":"fixed","version":"1.8.9"}]}],"versions":["1.2.0","1.2.0-rc.0","1.2.0-rc.1","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.0-rc.0","1.3.0-rc.1","1.3.0-rc.2","1.3.0-rc.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.0-rc.0","1.4.0-rc.1","1.4.0-rc.2","1.4.0-rc.3","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-rc.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.0-rc.0","1.6.0-rc.1","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.0-rc.0","1.7.0-rc.1","1.7.0-rc.2","1.7.0-rc.3","1.7.1","1.7.10","1.7.11","1.7.12","1.7.13","1.7.14","1.7.15","1.7.16","1.7.17","1.7.18","1.7.19","1.7.2","1.7.20","1.7.21","1.7.22","1.7.23","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.0-rc.0","1.8.0-rc.1","1.8.0-rc.2","1.8.0-rc.3","1.8.0-rc.4","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0-rc.0"},{"kind":"fixed","version":"1.5.15"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0-rc.0"},{"kind":"fixed","version":"1.6.17"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0-rc.0"},{"kind":"fixed","version":"1.7.24"}]},{"type":"SEMVER","events":[{"kind":"introduced","version":"1.8.0-rc.0"},{"kind":"fixed","version":"1.8.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Unspecified ecosystem","name":"https://github.com/phoenixframework/phoenix","ranges":[{"type":"GIT","events":[{"kind":"introduced","version":"2270aaf21bd02c6a6a1022820564efb605a97655"},{"kind":"fixed","version":"7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8"},{"kind":"fixed","version":"89a1c4be161e436241e12b2378a719904b9bd96f"},{"kind":"fixed","version":"b90b22521465ece00eb5a19d5aa2b9465b209c85"},{"kind":"fixed","version":"beffc4da1e787e572121f68902c63daf4fe7d9c2"}]}],"versions":["v1.5.13","v1.6.16","v1.7.23","v1.8.8","v1.8.7","v1.8.6","v1.7.22","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.8.0-rc.4","v1.8.0-rc.3","v1.8.0-rc.2","v1.8.0-rc.1","v1.8.0-rc.0","v1.7.20","v1.7.19","v1.7.18","v1.7.16","v1.7.15","v1.7.14","v1.7.13","v1.7.12","v1.7.11","v1.7.10","v1.7.9","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.7.0-rc.3","v1.7.0-rc.2","v1.7.0-rc.1","v1.7.0-rc.0","v1.6.15","v1.6.14","v1.6.13","v1.6.12","v1.6.11","v1.6.10","v1.6.7","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.6.0-rc.1","v1.6.0-rc.0","v1.5.12","v1.5.11","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.5.0-rc.0","v1.4.0","v1.4.0-rc.3","v1.4.0-rc.2","v1.4.0-rc.1","v1.4.0-rc.0","v1.3.0","v1.3.0-rc.3","v1.3.0-rc.2","v1.3.0-rc.1","v1.3.0-rc.0","v1.2.0","v1.2.0-rc.1","v1.2.0-rc.0"],"rawVersionEvidence":"{\"ranges\":[{\"type\":\"GIT\",\"repo\":\"https://github.com/phoenixframework/phoenix\",\"events\":[{\"introduced\":\"2270aaf21bd02c6a6a1022820564efb605a97655\"},{\"fixed\":\"7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8\"},{\"fixed\":\"89a1c4be161e436241e12b2378a719904b9bd96f\"},{\"fixed\":\"b90b22521465ece00eb5a19d5aa2b9465b209c85\"},{\"fixed\":\"beffc4da1e787e572121f68902c63daf4fe7d9c2\"}]}],\"versions\":[\"v1.5.13\",\"v1.6.16\",\"v1.7.23\",\"v1.8.8\",\"v1.8.7\",\"v1.8.6\",\"v1.7.22\",\"v1.8.5\",\"v1.8.4\",\"v1.8.3\",\"v1.8.2\",\"v1.8.1\",\"v1.8.0\",\"v1.8.0-rc.4\",\"v1.8.0-rc.3\",\"v1.8.0-rc.2\",\"v1.8.0-rc.1\",\"v1.8.0-rc.0\",\"v1.7.20\",\"v1.7.19\",\"v1.7.18\",\"v1.7.16\",\"v1.7.15\",\"v1.7.14\",\"v1.7.13\",\"v1.7.12\",\"v1.7.11\",\"v1.7.10\",\"v1.7.9\",\"v1.7.8\",\"v1.7.7\",\"v1.7.6\",\"v1.7.5\",\"v1.7.4\",\"v1.7.3\",\"v1.7.2\",\"v1.7.1\",\"v1.7.0\",\"v1.7.0-rc.3\",\"v1.7.0-rc.2\",\"v1.7.0-rc.1\",\"v1.7.0-rc.0\",\"v1.6.15\",\"v1.6.14\",\"v1.6.13\",\"v1.6.12\",\"v1.6.11\",\"v1.6.10\",\"v1.6.7\",\"v1.6.6\",\"v1.6.5\",\"v1.6.4\",\"v1.6.3\",\"v1.6.2\",\"v1.6.1\",\"v1.6.0\",\"v1.6.0-rc.1\",\"v1.6.0-rc.0\",\"v1.5.12\",\"v1.5.11\",\"v1.5.10\",\"v1.5.9\",\"v1.5.8\",\"v1.5.7\",\"v1.5.6\",\"v1.5.5\",\"v1.5.4\",\"v1.5.3\",\"v1.5.2\",\"v1.5.1\",\"v1.5.0\",\"v1.5.0-rc.0\",\"v1.4.0\",\"v1.4.0-rc.3\",\"v1.4.0-rc.2\",\"v1.4.0-rc.1\",\"v1.4.0-rc.0\",\"v1.3.0\",\"v1.3.0-rc.3\",\"v1.3.0-rc.2\",\"v1.3.0-rc.1\",\"v1.3.0-rc.0\",\"v1.2.0\",\"v1.2.0-rc.1\",\"v1.2.0-rc.0\"],\"database_specific\":{\"source\":\"https://cna.erlef.org/osv/EEF-CVE-2026-56812.json\"}}"}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null}],"references":["https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://cna.erlef.org/cves/CVE-2026-56812.html","https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2","https://hex.pm/packages/phoenix","https://www.npmjs.com/package/phoenix"],"sourceUrl":"https://osv.dev/vulnerability/EEF-CVE-2026-56812","license":"OSV · upstream source license applies","key":"osv:EEF-CVE-2026-56812","identifiers":["EEF-CVE-2026-56812","CVE-2026-56812","GHSA-63mc-hw7g-86rr"]},"retained":false,"historicalAffected":[]},{"revision":"a95a37dba1ff468785952d5afb28feab","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-63mc-hw7g-86rr","aliases":["CVE-2026-56812","EEF-CVE-2026-56812"],"title":"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks","description":"### Summary\n\nThe Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already exists using a bare truthiness check (`state[key]`) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, and similar) makes the lookup return the inherited `Object.prototype` object instead of `undefined`, which is truthy. The code then reads `.metas.map(...)` off it and throws an uncaught `TypeError`, breaking presence sync for every viewer of that channel topic. Any authenticated channel participant can trigger it.\n\n### Details\n\nThe victim is any browser subscribed to a presence channel. When it receives the server's `presence_state` message, it invokes `Presence.syncState`, which iterates the incoming presences and checks whether each one already exists locally via `let currentPresence = state[key]`. `state` is a plain object inheriting from `Object.prototype`. For an ordinary key like `alice`, `state[\"alice\"]` is `undefined` (falsy) and the safe path runs. For the key `__proto__` (or `constructor`, `toString`, etc.), `state[\"__proto__\"]` does not resolve to a tracked presence but to JavaScript's built-in `Object.prototype`, which is truthy. The `if(currentPresence)` guard passes, and the code evaluates `currentPresence.metas.map(m => m.phx_ref)`. Since `Object.prototype.metas` is `undefined`, calling `.map` on it throws a `TypeError`.\n\nPhoenix wraps no try/catch around channel binding callbacks, so the `TypeError` propagates out of the message handler: `this.state` is never updated and `onSync()` never fires. The malicious key is tracked server-side, so it is re-pushed on every presence update and keeps re-throwing, leaving presence permanently broken until the attacker leaves. `Presence.syncDiff` uses the same unsafe `state[key]` existence-check pattern, so presence diffs fail identically.\n\nTwo scoping points matter. The impact is per channel topic, not global: presence state is per-topic on the server and per-`Presence`-instance in the browser, so only viewers of the topic carrying the malicious key are affected. The bug is a read-time confusion of the prototype object, not prototype pollution: the crash occurs on the `state[\"__proto__\"]` read in `syncState`, before any `state[key] = ...` write is reached, so `Object.prototype` is never mutated and nothing leaks across channels. The fix builds the state and accumulator objects with `Object.create(null)` (or a `Map`) and gates existence checks with `Object.prototype.hasOwnProperty.call(obj, key)`.\n\nIf an application does not pass a client-controlled key to `Presence.track`, it is **not** affected.\n\n### PoC\n\n1. Connect to an application that uses `Phoenix.Presence` and tracks presences under a client-chosen key (e.g. a username).\n2. Join a presence channel choosing the key `__proto__` (or `constructor`, `toString`, `hasOwnProperty`).\n3. The server tracks the presence and pushes `presence_state` / `presence_diff` to every subscriber of that topic.\n4. Each viewer's `Presence.syncState` (or `syncDiff`) reads `state[\"__proto__\"]`, gets the truthy `Object.prototype`, and throws an uncaught `TypeError`.\n5. Presence sync stays broken for all viewers of the topic until the attacker leaves the channel.\n\n### Impact\n\nAn attacker with ordinary channel access can cause a persistent, stored client-side denial of service against every browser viewing a presence channel topic, freezing presence updates for all of them until the attacker disconnects. Any application driving the Phoenix JavaScript presence client with user-influenced presence keys is affected.","state":0,"publishedAt":"2026-09-03T20:30:33+00:00","modifiedAt":"2026-09-03T20:45:04.9850922+00:00","affected":[{"ecosystem":"Hex","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0-rc.0"},{"kind":"fixed","version":"1.5.15"}]}],"versions":["1.2.0","1.2.0-rc.0","1.2.0-rc.1","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.0-rc.0","1.3.0-rc.1","1.3.0-rc.2","1.3.0-rc.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.0-rc.0","1.4.0-rc.1","1.4.0-rc.2","1.4.0-rc.3","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-rc.0","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9"],"rawVersionEvidence":null},{"ecosystem":"Hex","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0-rc.0"},{"kind":"fixed","version":"1.6.17"}]}],"versions":["1.6.0","1.6.0-rc.0","1.6.0-rc.1","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"],"rawVersionEvidence":null},{"ecosystem":"Hex","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0-rc.0"},{"kind":"fixed","version":"1.7.24"}]}],"versions":["1.7.0","1.7.0-rc.0","1.7.0-rc.1","1.7.0-rc.2","1.7.0-rc.3","1.7.1","1.7.10","1.7.11","1.7.12","1.7.13","1.7.14","1.7.15","1.7.16","1.7.17","1.7.18","1.7.19","1.7.2","1.7.20","1.7.21","1.7.22","1.7.23","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9"],"rawVersionEvidence":null},{"ecosystem":"Hex","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.8.0-rc.0"},{"kind":"fixed","version":"1.8.9"}]}],"versions":["1.8.0","1.8.0-rc.0","1.8.0-rc.1","1.8.0-rc.2","1.8.0-rc.3","1.8.0-rc.4","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0-rc.0"},{"kind":"fixed","version":"1.5.15"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0-rc.0"},{"kind":"fixed","version":"1.6.17"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0-rc.0"},{"kind":"fixed","version":"1.7.24"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"phoenix","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.8.0-rc.0"},{"kind":"fixed","version":"1.8.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://nvd.nist.gov/vuln/detail/CVE-2026-56812","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2","https://cna.erlef.org/cves/CVE-2026-56812.html","https://github.com/phoenixframework/phoenix","https://osv.dev/vulnerability/EEF-CVE-2026-56812"],"sourceUrl":"https://github.com/advisories/GHSA-63mc-hw7g-86rr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-63mc-hw7g-86rr","identifiers":["GHSA-63mc-hw7g-86rr","CVE-2026-56812","EEF-CVE-2026-56812"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}