Server-Side Rendering Vulnerability in djust Affects Performance and Security
CVE-2026-61590

7.4HIGH

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61590?

The djust framework, which integrates Phoenix LiveView-style reactive server-side rendering with Rust performance, contains a significant vulnerability prior to version 1.0.7. This flaw arises from the improper configuration of its observability endpoints, which allowed attackers to access and read live application state and invoke remote methods without proper restrictions. While the settings initially appeared secure, the reliance on a separately-installed middleware and the presence of 'DEBUG' mode created a pathway for non-localhost clients to exploit these functions. Djust version 1.0.7 addresses this by enforcing localhost restrictions on every observability endpoint and securing the eval_handler, ensuring that unauthorized requests do not yield sensitive information. For enhanced security, users are advised to keep the 'DEBUG' setting off in production and restrict access to these endpoints from untrusted networks.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.