CVE-2026-56812: phoenix from 1.2.0 (inclusive), before 1.5.15 (exclusive), from 1.6.0 (inclusive), before 1.6.17 (exclusive), from…

Affected technology

phoenix · from 1.2.0 (inclusive), before 1.5.15 (exclusive)
phoenixframework

phoenix · from 1.6.0 (inclusive), before 1.6.17 (exclusive)
phoenixframework

phoenix · from 1.7.0 (inclusive), before 1.7.24 (exclusive)
phoenixframework

phoenix · from 1.8.0 (inclusive), before 1.8.9 (exclusive)
phoenixframework

phoenix · 1.2.0-rc.0 to before 1.5.15, 1.6.0-rc.0 to before 1.6.17, 1.7.0-rc.0 to before 1.7.24, 1.8.0-rc.0 to before 1.8.9
phoenixframework

phoenix · 2270aaf21bd02c6a6a1022820564efb605a97655 to before *; status changes: 7f7b971c1ea0994e3fbd1c11ddb05e780bd38ad8 — unaffected, 89a1c4be161e436241e12b2378a719904b9bd96f — unaffected, b90b22521465ece00eb5a19d5aa2b9465b209c85 — unaffected, beffc4da1e787e572121f68902c63daf4fe7d9c2 — unaffected
phoenixframework

Component: Presence
Function: Presence.syncState, Presence.syncDiff
File: assets/js/phoenix/presence.js

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker with ordinary channel access can cause a persistent client-side denial of service against every viewer of a presence channel topic. Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as none; availability impact as low.