Denial of Service Vulnerability in Phoenix Framework Presence JavaScript Client

CVE-2026-56812

What is CVE-2026-56812?

A vulnerability exists in the Phoenix Framework's Presence JavaScript client, where an improper truthiness check allows attackers with basic channel access to exploit presence keys. By choosing keys that overlap with Object.prototype members, attackers can trigger an uncaught TypeError, leading to a persistent denial of service for all viewers on the same channel topic. As this issue affects only specific presence topics and does not result in Object.prototype mutation, the impact is confined yet disruptive. Developers are advised to upgrade to the patched versions to mitigate this vulnerability.

References