phoenix (Hex)
Advisories
17
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.8.9 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:phoenix, "~> 1.8.9"} # then: mix deps.update phoenixKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff |
High EPSS 0.80% |
>= 1.2.0-rc.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17>= 1.7.0-rc.0, < 1.7.24>= 1.8.0-rc.0, < 1.8.9 | 1.5.151.6.171.7.241.8.9 |
| EEF-CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff |
High EPSS 0.80% |
>= 1.8.0-rc.0, < 1.8.9 | 1.8.9 |
| EEF-CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff |
High EPSS 0.80% |
>= 1.7.0-rc.0, < 1.7.24 | 1.7.24 |
| EEF-CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff |
High EPSS 0.80% |
>= 1.6.0-rc.0, < 1.6.17 | 1.6.17 |
| EEF-CVE-2026-56812 Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff |
High EPSS 0.80% |
>= 1.2.0-rc.0, < 1.5.15 | 1.5.15 |
| GHSA-6983-jfq8-485w Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service |
High EPSS 0.78% |
>= 1.8.0-rc.0, < 1.8.9 | 1.8.9 |
| GHSA-6983-jfq8-485w Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service |
High EPSS 0.78% |
>= 0.11.0, < 1.5.15>= 1.6.0-rc.0, < 1.6.17>= 1.7.0-rc.0, < 1.7.24>= 1.8.0-rc.0, < 1.8.9 | 1.5.151.6.171.7.241.8.9 |
| GHSA-6983-jfq8-485w Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service |
High EPSS 0.78% |
>= 0.11.0, < 1.5.15 | 1.5.15 |
| GHSA-6983-jfq8-485w Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service |
High EPSS 0.78% |
>= 1.6.0-rc.0, < 1.6.17 | 1.6.17 |
| GHSA-6983-jfq8-485w Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service |
High EPSS 0.78% |
>= 1.7.0-rc.0, < 1.7.24 | 1.7.24 |
| GHSA-628h-q48j-jr6q Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix |
High EPSS 0.47% |
>= 1.8.0, < 1.8.6 | 1.8.6 |
| GHSA-628h-q48j-jr6q Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix |
High EPSS 0.47% |
>= 1.7.0, < 1.7.22 | 1.7.22 |
| GHSA-628h-q48j-jr6q Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix |
High EPSS 0.47% |
>= 1.7.0, < 1.7.22>= 1.8.0, < 1.8.6 | 1.7.221.8.6 |
| GHSA-p8f7-22gq-m7j9 Phoenix before 1.6.14 mishandles check_origin wildcarding |
High EPSS 0.62% |
< 1.6.14 | 1.6.14 |
| GHSA-cmfh-8f8r-fj96 Phoenix Arbitrary URL Redirect |
Medium EPSS 2.38% |
>= 1.2.0, < 1.2.3 | 1.2.3 |
| GHSA-cmfh-8f8r-fj96 Phoenix Arbitrary URL Redirect |
Medium EPSS 2.38% |
>= 1.1.0, < 1.1.8 | 1.1.8 |
| GHSA-cmfh-8f8r-fj96 Phoenix Arbitrary URL Redirect |
Medium EPSS 2.38% |
< 1.0.6 | 1.0.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor