Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

phoenix

5 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 3 high, 1 medium
Registry
Hex

Advisories 5

  • CVE-2026-56812Medium 6.3

    Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

    Affected: from 1.2.0-rc.0, fixed in 1.5.15; from 1.6.0-rc.0, fixed in 1.6.17; from 1.7.0-rc.0, fixed in 1.7.24; from 1.8.0-rc.0, fixed in 1.8.9; from 1.2.0-rc.0, fixed in 1.5.15; from 1.6.0-rc.0, fixed in 1.6.17; from 1.7.0-rc.0, fixed in 1.7.24; from 1.8.0-rc.0, fixed in 1.8.9.

  • Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

    Affected: from 0.11.0, fixed in 1.5.15; from 1.6.0-rc.0, fixed in 1.6.17; from 1.7.0-rc.0, fixed in 1.7.24; from 1.8.0-rc.0, fixed in 1.8.9; from 0.11.0, fixed in 1.5.15; from 1.6.0-rc.0, fixed in 1.6.17; from 1.7.0-rc.0, fixed in 1.7.24; from 1.8.0-rc.0, fixed in 1.8.9.

  • Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix

    Affected: from 1.7.0, fixed in 1.7.22; from 1.8.0, fixed in 1.8.6; from 1.7.0, fixed in 1.7.22; from 1.8.0, fixed in 1.8.6; from 1.7.0, fixed in 1.7.22; from 1.8.0, fixed in 1.8.6.

  • socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding.

    Affected: fixed in 1.6.14.

  • The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL…

    Affected: fixed in 1.0.6; from 1.1.0, fixed in 1.1.8; from 1.2.0, fixed in 1.2.3.