npm/phoenix CVE-2026-56812: high 7.5, EPSS 0.80%
Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
Action: Upgrade phoenix to 1.5.15 (1.5.x), 1.6.17 (1.6.x), 1.7.24 (1.7.x) or 1.8.9 (1.8.x) or later.
npm i phoenix@1.5.15npm i phoenix@1.6.17npm i phoenix@1.7.24npm i phoenix@1.8.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0-rc.0 | 1.5.15 | - |
| 1.6.0-rc.0 | 1.6.17 | - |
| 1.7.0-rc.0 | 1.7.24 | - |
| 1.8.0-rc.0 | 1.8.9 | - |
Fixed versions
| 1.5.15 | 1.6.17 | 1.7.24 | 1.8.9 |
Sources
- osv: EEF-CVE-2026-56812
- nvd: CVE-2026-56812
- https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr
- https://cna.erlef.org/cves/CVE-2026-56812.html
- https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655
- https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8
- https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f
- https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85
- https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2
- https://hex.pm/packages/phoenix
- https://www.npmjs.com/package/phoenix
CVE-2026-56812 · published · modified · JSON