Resource Exhaustion Vulnerability in PhoenixStorybook by Phenixdigital

CVE-2026-8469

What is CVE-2026-8469?

A resource exhaustion vulnerability within the PhoenixStorybook framework allows unauthenticated users to trigger denial-of-service conditions through the unverified allocation of BEAM atoms. Multiple handlers manipulate user-supplied event parameters directly via String.to_atom/1 without appropriate input validation, leading to the permanent allocation of atom entries in the BEAM atom table. When an attacker provides unique strings to the affected handlers, excessive entries can cause the atom table boundary to be reached, ultimately leading to failure of the BEAM node and taking down all applications tied to it. The vulnerability affects the product versions from 0.2.0 up to, but not including, 1.1.0.

References