GHSA-63mc-hw7g-86rrPublished

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

cve-program · CVE-2026-56812

Published

phoenix

https://repo.hex.pm

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenix",
                    "packageURL": "pkg:hex/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "lessThan": "1.5.15",
                            "status": "affected",
                            "version": "1.2.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.6.17",
                            "status": "affected",
                            "version": "1.6.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.7.24",
                            "status": "affected",
                            "version": "1.7.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.8.9",
                            "status": "affected",
                            "version": "1.8.0-rc.0",
                            "versionType": "semver"
                        }
                    ]
                }

phoenix

https://registry.npmjs.org

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://registry.npmjs.org",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenix",
                    "packageURL": "pkg:npm/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "lessThan": "1.5.15",
                            "status": "affected",
                            "version": "1.2.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.6.17",
                            "status": "affected",
                            "version": "1.6.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.7.24",
                            "status": "affected",
                            "version": "1.7.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.8.9",
                            "status": "affected",
                            "version": "1.8.0-rc.0",
                            "versionType": "semver"
                        }
                    ]
                }

phoenixframework/phoenix

https://github.com

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenixframework/phoenix",
                    "packageURL": "pkg:github/phoenixframework/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "89a1c4be161e436241e12b2378a719904b9bd96f",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "b90b22521465ece00eb5a19d5aa2b9465b209c85",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "beffc4da1e787e572121f68902c63daf4fe7d9c2",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "2270aaf21bd02c6a6a1022820564efb605a97655",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-42050

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jul 7, 2026, 3:22:46 PM

dateUpdated: Sep 24, 2026, 9:29:18 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-56812

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-754

Original publisher date fields

published: 2026-07-07T16:16:40.920

lastModified: 2026-10-25T20:10:00.147

1 source CPE criteria · context only

cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · EEF-CVE-2026-56812

Published

phoenix

Hex

SEMVER · introduced 1.2.0-rc.0 → fixed 1.5.15

SEMVER · introduced 1.6.0-rc.0 → fixed 1.6.17

SEMVER · introduced 1.7.0-rc.0 → fixed 1.7.24

SEMVER · introduced 1.8.0-rc.0 → fixed 1.8.9

118 explicitly affected versions

1.2.0, 1.2.0-rc.0, 1.2.0-rc.1, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3.0, 1.3.0-rc.0, 1.3.0-rc.1, 1.3.0-rc.2, 1.3.0-rc.3, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4.0, 1.4.0-rc.0, 1.4.0-rc.1, 1.4.0-rc.2, 1.4.0-rc.3, 1.4.1, 1.4.10, 1.4.11, 1.4.12, 1.4.13, 1.4.14, 1.4.15, 1.4.16, 1.4.17, 1.4.18, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.5.0, 1.5.0-rc.0, 1.5.1, 1.5.10, 1.5.11, 1.5.12, 1.5.13, 1.5.14, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.6.0-rc.0, 1.6.0-rc.1, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.7.0, 1.7.0-rc.0, 1.7.0-rc.1, 1.7.0-rc.2, 1.7.0-rc.3, 1.7.1, 1.7.10, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.7.19, 1.7.2, 1.7.20, 1.7.21, 1.7.22, 1.7.23, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0, 1.8.0-rc.0, 1.8.0-rc.1, 1.8.0-rc.2, 1.8.0-rc.3, 1.8.0-rc.4, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.8.8

phoenix

npm

SEMVER · introduced 1.2.0-rc.0 → fixed 1.5.15

SEMVER · introduced 1.6.0-rc.0 → fixed 1.6.17

SEMVER · introduced 1.7.0-rc.0 → fixed 1.7.24

SEMVER · introduced 1.8.0-rc.0 → fixed 1.8.9

https://github.com/phoenixframework/phoenix

Unspecified ecosystem

GIT · introduced 2270aaf21bd02c6a6a1022820564efb605a97655 → fixed 7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8 → fixed 89a1c4be161e436241e12b2378a719904b9bd96f → fixed b90b22521465ece00eb5a19d5aa2b9465b209c85 → fixed beffc4da1e787e572121f68902c63daf4fe7d9c2

85 explicitly affected versions

v1.5.13, v1.6.16, v1.7.23, v1.8.8, v1.8.7, v1.8.6, v1.7.22, v1.8.5, v1.8.4, v1.8.3, v1.8.2, v1.8.1, v1.8.0, v1.8.0-rc.4, v1.8.0-rc.3, v1.8.0-rc.2, v1.8.0-rc.1, v1.8.0-rc.0, v1.7.20, v1.7.19, v1.7.18, v1.7.16, v1.7.15, v1.7.14, v1.7.13, v1.7.12, v1.7.11, v1.7.10, v1.7.9, v1.7.8, v1.7.7, v1.7.6, v1.7.5, v1.7.4, v1.7.3, v1.7.2, v1.7.1, v1.7.0, v1.7.0-rc.3, v1.7.0-rc.2, v1.7.0-rc.1, v1.7.0-rc.0, v1.6.15, v1.6.14, v1.6.13, v1.6.12, v1.6.11, v1.6.10, v1.6.7, v1.6.6, v1.6.5, v1.6.4, v1.6.3, v1.6.2, v1.6.1, v1.6.0, v1.6.0-rc.1, v1.6.0-rc.0, v1.5.12, v1.5.11, v1.5.10, v1.5.9, v1.5.8, v1.5.7, v1.5.6, v1.5.5, v1.5.4, v1.5.3, v1.5.2, v1.5.1, v1.5.0, v1.5.0-rc.0, v1.4.0, v1.4.0-rc.3, v1.4.0-rc.2, v1.4.0-rc.1, v1.4.0-rc.0, v1.3.0, v1.3.0-rc.3, v1.3.0-rc.2, v1.3.0-rc.1, v1.3.0-rc.0, v1.2.0, v1.2.0-rc.1, v1.2.0-rc.0

Original vendor version evidence · not evaluated as a NuGet range

{"ranges":[{"type":"GIT","repo":"https://github.com/phoenixframework/phoenix","events":[{"introduced":"2270aaf21bd02c6a6a1022820564efb605a97655"},{"fixed":"7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8"},{"fixed":"89a1c4be161e436241e12b2378a719904b9bd96f"},{"fixed":"b90b22521465ece00eb5a19d5aa2b9465b209c85"},{"fixed":"beffc4da1e787e572121f68902c63daf4fe7d9c2"}]}],"versions":["v1.5.13","v1.6.16","v1.7.23","v1.8.8","v1.8.7","v1.8.6","v1.7.22","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.8.0-rc.4","v1.8.0-rc.3","v1.8.0-rc.2","v1.8.0-rc.1","v1.8.0-rc.0","v1.7.20","v1.7.19","v1.7.18","v1.7.16","v1.7.15","v1.7.14","v1.7.13","v1.7.12","v1.7.11","v1.7.10","v1.7.9","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.7.0-rc.3","v1.7.0-rc.2","v1.7.0-rc.1","v1.7.0-rc.0","v1.6.15","v1.6.14","v1.6.13","v1.6.12","v1.6.11","v1.6.10","v1.6.7","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.6.0-rc.1","v1.6.0-rc.0","v1.5.12","v1.5.11","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.5.0-rc.0","v1.4.0","v1.4.0-rc.3","v1.4.0-rc.2","v1.4.0-rc.1","v1.4.0-rc.0","v1.3.0","v1.3.0-rc.3","v1.3.0-rc.2","v1.3.0-rc.1","v1.3.0-rc.0","v1.2.0","v1.2.0-rc.1","v1.2.0-rc.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-56812.json"}}

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-63mc-hw7g-86rr

Published

phoenix

Hex

SEMVER · introduced 1.2.0-rc.0 → fixed 1.5.15

57 explicitly affected versions

phoenix

Hex

SEMVER · introduced 1.6.0-rc.0 → fixed 1.6.17

19 explicitly affected versions

1.6.0, 1.6.0-rc.0, 1.6.0-rc.1, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9

phoenix

Hex

SEMVER · introduced 1.7.0-rc.0 → fixed 1.7.24

28 explicitly affected versions

1.7.0, 1.7.0-rc.0, 1.7.0-rc.1, 1.7.0-rc.2, 1.7.0-rc.3, 1.7.1, 1.7.10, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.7.19, 1.7.2, 1.7.20, 1.7.21, 1.7.22, 1.7.23, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9

phoenix

Hex

SEMVER · introduced 1.8.0-rc.0 → fixed 1.8.9

14 explicitly affected versions

1.8.0, 1.8.0-rc.0, 1.8.0-rc.1, 1.8.0-rc.2, 1.8.0-rc.3, 1.8.0-rc.4, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.8.8

phoenix

npm

SEMVER · introduced 1.2.0-rc.0 → fixed 1.5.15

phoenix

npm

SEMVER · introduced 1.6.0-rc.0 → fixed 1.6.17

phoenix

npm

SEMVER · introduced 1.7.0-rc.0 → fixed 1.7.24

phoenix

npm

SEMVER · introduced 1.8.0-rc.0 → fixed 1.8.9

Original source record · Cite this exact observation · Complete original publisher JSON