MEDIUM GitHub
CVE-2026-56812
Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
### Summary
The Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already exists using a bare truthiness check (`state[key]`) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, and similar) makes th
Affected Products
- erlang/phoenix >= 1.2.0-rc.0, < 1.5.15
- erlang/phoenix >= 1.6.0-rc.0, < 1.6.17
- erlang/phoenix >= 1.7.0-rc.0, < 1.7.24
- erlang/phoenix >= 1.8.0-rc.0, < 1.8.9
- npm/phoenix >= 1.2.0-rc.0, < 1.5.15
- npm/phoenix >= 1.6.0-rc.0, < 1.6.17
References
- https://github.com/advisories/GHSA-63mc-hw7g-86rr
- https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr
- https://nvd.nist.gov/vuln/detail/CVE-2026-56812
- https://github.com/phoenixframework/phoenix/commit/7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad
This medium severity vulnerability was published on 2026-09-03 via GitHub. Affected: erlang/phoenix >= 1.2.0-rc.0, < 1.5.15, erlang/phoenix >= 1.6.0-rc.0, < 1.6.17, erlang/phoenix >= 1.7.0-rc.0, < 1.7.24 and 3 more.
vulnfeed aggregates 7617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.