By vendor

Phoenixframework vulnerabilities

Known CVEs affecting Phoenixframework products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-56811HIGH 7.5

  Phoenix is a popular web framework for Elixir applications. This vulnerability allows an attacker without credentials to crash a Phoenix application by opening a single WebSocket or long-polling connection and repeatedly sending join messages to create thousands of channel processes. The framework had no built-in limit on how many channels one connection could spawn, allowing a single attacker to exhaust the server's process capacity and prevent legitimate users from accessing the application. The fix introduces a configurable cap (default 100 channels per connection) that forces attackers to open multiple connections, where network-layer protections can block them.

• CVE-2026-56812HIGH 7.5

  A vulnerability in Phoenix Framework's JavaScript presence client allows attackers to crash the real-time presence feature for all users viewing a channel. By joining a presence channel with a specially crafted username (such as "__proto__" or "constructor"), an attacker can trigger a JavaScript error that breaks presence synchronization. Unlike many attacks, the attacker doesn't need special permissions—ordinary channel access is sufficient. The disruption persists as long as the attacker remains in the channel, affecting every viewer of that topic until they leave.