CVE-2026-56812Published

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-56812

Published

phoenix

https://repo.hex.pm

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenix",
                    "packageURL": "pkg:hex/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "lessThan": "1.5.15",
                            "status": "affected",
                            "version": "1.2.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.6.17",
                            "status": "affected",
                            "version": "1.6.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.7.24",
                            "status": "affected",
                            "version": "1.7.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.8.9",
                            "status": "affected",
                            "version": "1.8.0-rc.0",
                            "versionType": "semver"
                        }
                    ]
                }

phoenix

https://registry.npmjs.org

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://registry.npmjs.org",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenix",
                    "packageURL": "pkg:npm/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "lessThan": "1.5.15",
                            "status": "affected",
                            "version": "1.2.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.6.17",
                            "status": "affected",
                            "version": "1.6.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.7.24",
                            "status": "affected",
                            "version": "1.7.0-rc.0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "1.8.9",
                            "status": "affected",
                            "version": "1.8.0-rc.0",
                            "versionType": "semver"
                        }
                    ]
                }

phoenixframework/phoenix

https://github.com

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Presence"
                    ],
                    "packageName": "phoenixframework/phoenix",
                    "packageURL": "pkg:github/phoenixframework/phoenix",
                    "product": "phoenix",
                    "programFiles": [
                        "assets/js/phoenix/presence.js"
                    ],
                    "programRoutines": [
                        {
                            "name": "Presence.syncState"
                        },
                        {
                            "name": "Presence.syncDiff"
                        }
                    ],
                    "repo": "https://github.com/phoenixframework/phoenix",
                    "vendor": "phoenixframework",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "89a1c4be161e436241e12b2378a719904b9bd96f",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "b90b22521465ece00eb5a19d5aa2b9465b209c85",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "beffc4da1e787e572121f68902c63daf4fe7d9c2",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "2270aaf21bd02c6a6a1022820564efb605a97655",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON