{"action":"Upgrade phoenix to 1.5.15 (1.5.x), 1.6.17 (1.6.x), 1.7.24 (1.7.x) or 1.8.9 (1.8.x) or later.","affected":[{"fixed":"1.5.15","introduced":"1.2.0-rc.0"},{"fixed":"1.6.17","introduced":"1.6.0-rc.0"},{"fixed":"1.7.24","introduced":"1.7.0-rc.0"},{"fixed":"1.8.9","introduced":"1.8.0-rc.0"}],"component":"phoenix","cve_ids":["CVE-2026-56812"],"ecosystem":"npm","epss":0.00796,"exploited":false,"fixed_versions":["1.5.15","1.6.17","1.7.24","1.8.9"],"ghsa_id":"GHSA-63mc-hw7g-86rr","id":"tcs_01M5KERHF1YKCPE4QFYDMBRBS9","modified_at":"2026-09-24T21:30:06.586470584Z","published_at":"2026-07-07T15:22:46.933Z","references":["https://osv.dev/vulnerability/EEF-CVE-2026-56812","https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr","https://cna.erlef.org/cves/CVE-2026-56812.html","https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655","https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8","https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f","https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85","https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2","https://hex.pm/packages/phoenix","https://www.npmjs.com/package/phoenix"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"EEF-CVE-2026-56812","url":"https://osv.dev/vulnerability/EEF-CVE-2026-56812"},{"source":"nvd","source_id":"CVE-2026-56812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56812"}],"summary":"Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff"}