CVE-2026-56812: Phoenix JavaScript Presence Client Denial of Service Vulnerability

Background

Phoenix is a framework for building scalable and maintainable applications in Elixir, providing real-time features through channels and presence. The Phoenix JavaScript presence client allows applications to track user presence in real-time. However, it is vulnerable to a denial of service attack when presence keys collide with Object.prototype members, which can lead to persistent client-side crashes.

Vulnerability Detail

The vulnerability arises from an improper check for existing presence keys in the Phoenix JavaScript presence client. Instead of verifying if a key is an own property, the client uses a truthiness test, allowing an attacker to exploit this by choosing keys that are Object.prototype member names. This results in a TypeError when the client attempts to access properties of the prototype, causing a denial of service for all viewers of the affected presence channel.

Workaround

As a temporary workaround, reject or sanitize presence keys that collide with JavaScript Object.prototype member names before calling Phoenix.Presence.track. For example, you can implement a check like this:

const invalidKeys = ['__proto__', 'constructor', 'prototype', 'toString', 'hasOwnProperty'];

function isValidKey(key) {
    return !invalidKeys.includes(key);
}

if (isValidKey(presenceKey)) {
    Phoenix.Presence.track(presenceKey, ...);
} else {
    console.error('Invalid presence key.');
}

Conclusion

CVE-2026-56812 presents a significant risk to applications using the Phoenix JavaScript presence client, allowing for denial of service attacks through improper handling of presence keys. It is crucial to update to the latest patched versions or implement workarounds to mitigate this vulnerability.

See every vulnerability recorded for phoenix →

FAQ