← Back to CVE Explorer

CVE-2026-56812

Full vulnerability record from the local CVENow database.

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff. The Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError. The exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution). This issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.

Severity
MEDIUM
CVSS score
6.3 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-07 16:16:40.920000
Last modified
2026-10-25 20:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-56812",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-07-07T16:16:40.920",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic.\n\nThis vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and Presence.syncDiff.\n\nThe Phoenix JavaScript presence client checks whether a presence already exists with a bare truthiness test (state[key]) instead of an own-property check. Presence keys can be attacker-controlled, because applications track presences under a username or id supplied by the client. A user who joins a channel choosing a key that is an Object.prototype member name (__proto__, constructor, toString, hasOwnProperty, and similar) makes that lookup return JavaScript's built-in Object.prototype instead of undefined. Because the prototype is truthy, the code treats it as an existing presence and reads .metas.map(...) off it, which throws an uncaught TypeError.\n\nThe exception propagates out of the presence message handler, so the local state is never updated and onSync() never fires. Because the malicious key is tracked on the server, it is re-pushed on every presence update and keeps re-throwing, so presence sync stays broken for every viewer of that channel topic until the attacker leaves. Both syncState and syncDiff use the same unsafe existence-check pattern. The impact is limited to the affected topic and is a read-time confusion of the prototype object, not a mutation of Object.prototype (it is not prototype pollution).\n\nThis issue affects phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9; phoenix: from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad ’Comprobación Incorrecta de Condiciones Inusuales o Excepcionales’ en phoenixframework phoenix (cliente JavaScript de Presencia) permite a un atacante con acceso ordinario al canal causar una denegación de servicio persistente del lado del cliente contra cada espectador de un tema de canal de presencia.\n\nEsta vulnerabilidad está asociada con los archivos de programa assets/js/phoenix/presence.js y las rutinas de programa Presence.syncState y Presence.syncDiff.\n\nEl cliente de presencia JavaScript de Phoenix comprueba si una presencia ya existe con una simple prueba de veracidad (state[key]) en lugar de una comprobación de propiedad propia. Las claves de presencia pueden ser controladas por el atacante, porque las aplicaciones rastrean las presencias bajo un nombre de usuario o ID suministrado por el cliente. Un usuario que se une a un canal eligiendo una clave que es un nombre de miembro de Object.prototype (__proto__, constructor, toString, hasOwnProperty, y similares) hace que esa búsqueda devuelva el Object.prototype incorporado de JavaScript en lugar de undefined. Debido a que el prototipo es verdadero, el código lo trata como una presencia existente y lee .metas.map(...) de él, lo que lanza un TypeError no capturado.\n\nLa excepción se propaga fuera del gestor de mensajes de presencia, por lo que el estado local nunca se actualiza y onSync() nunca se dispara. Debido a que la clave maliciosa es rastreada en el servidor, se vuelve a enviar en cada actualización de presencia y sigue lanzando errores, por lo que la sincronización de presencia permanece rota para cada espectador de ese tema de canal hasta que el atacante se va. Tanto syncState como syncDiff utilizan el mismo patrón inseguro de comprobación de existencia. El impacto se limita al tema afectado y es una confusión en tiempo de lectura del objeto prototipo, no una mutación de Object.prototype (no es contaminación de prototipos).\n\nEste problema afecta a phoenix: desde 1.2.0-rc.0 antes de 1.5.15, desde 1.6.0-rc.0 antes de 1.6.17, desde 1.7.0-rc.0 antes de 1.7.24, y desde 1.8.0-rc.0 antes de 1.8.9."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "phoenixframework",
          "product": "phoenix",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "phoenix",
          "cpes": [
            "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Presence"
          ],
          "programFiles": [
            "assets/js/phoenix/presence.js"
          ],
          "programRoutines": [
            {
              "name": "Presence.syncState"
            },
            {
              "name": "Presence.syncDiff"
            }
          ],
          "repo": "https://github.com/phoenixframework/phoenix",
          "packageURL": "pkg:hex/phoenix",
          "versions": [
            {
              "version": "1.2.0-rc.0",
              "lessThan": "1.5.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.6.0-rc.0",
              "lessThan": "1.6.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.7.0-rc.0",
              "lessThan": "1.7.24",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.8.0-rc.0",
              "lessThan": "1.8.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "phoenixframework",
          "product": "phoenix",
          "defaultStatus": "unaffected",
          "collectionURL": "https://registry.npmjs.org",
          "packageName": "phoenix",
          "cpes": [
            "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Presence"
          ],
          "programFiles": [
            "assets/js/phoenix/presence.js"
          ],
          "programRoutines": [
            {
              "name": "Presence.syncState"
            },
            {
              "name": "Presence.syncDiff"
            }
          ],
          "repo": "https://github.com/phoenixframework/phoenix",
          "packageURL": "pkg:npm/phoenix",
          "versions": [
            {
              "version": "1.2.0-rc.0",
              "lessThan": "1.5.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.6.0-rc.0",
              "lessThan": "1.6.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.7.0-rc.0",
              "lessThan": "1.7.24",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.8.0-rc.0",
              "lessThan": "1.8.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "phoenixframework",
          "product": "phoenix",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "phoenixframework/phoenix",
          "cpes": [
            "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Presence"
          ],
          "programFiles": [
            "assets/js/phoenix/presence.js"
          ],
          "programRoutines": [
            {
              "name": "Presence.syncState"
            },
            {
              "name": "Presence.syncDiff"
            }
          ],
          "repo": "https://github.com/phoenixframework/phoenix",
          "packageURL": "pkg:github/phoenixframework/phoenix",
          "versions": [
            {
              "version": "2270aaf21bd02c6a6a1022820564efb605a97655",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8",
                  "status": "unaffected"
                },
                {
                  "at": "89a1c4be161e436241e12b2378a719904b9bd96f",
                  "status": "unaffected"
                },
                {
                  "at": "b90b22521465ece00eb5a19d5aa2b9465b209c85",
                  "status": "unaffected"
                },
                {
                  "at": "beffc4da1e787e572121f68902c63daf4fe7d9c2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T16:11:03.353715Z",
          "id": "CVE-2026-56812",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.2.0",
              "versionEndExcluding": "1.5.15",
              "matchCriteriaId": "3CF8EA55-C063-4742-87ED-53E1998977B5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.6.0",
              "versionEndExcluding": "1.6.17",
              "matchCriteriaId": "809E49A8-D727-4E05-BBF9-F9E34077E4A4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.7.0",
              "versionEndExcluding": "1.7.24",
              "matchCriteriaId": "3257C901-8FC3-4107-95C6-C57F909FFE40"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.8.0",
              "versionEndExcluding": "1.8.9",
              "matchCriteriaId": "8F98C1AC-1593-43EB-929A-4D3B7597C9BC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-56812.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/commit/2270aaf21bd02c6a6a1022820564efb605a97655",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/commit/89a1c4be161e436241e12b2378a719904b9bd96f",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/commit/b90b22521465ece00eb5a19d5aa2b9465b209c85",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/commit/beffc4da1e787e572121f68902c63daf4fe7d9c2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56812",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}