CVE-2026-32689
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In the Phoenix (Elixir) long-poll transport, a POST request with Content-Type application/x-ndjson splits the request body on newline characters without limiting the number of segments. A body consisting entirely of newline bytes causes massive memory amplification and BEAM resource exhaustion, crashing the node and terminating sessions.
Risk Assessment
An attacker can cause a denial of service (DoS) and terminate all active sessions on the node. The session token required to reach the vulnerable endpoint is freely obtainable without authentication, making the attack effectively unauthenticated.
Recommendation
Upgrade Phoenix to version 1.7.22 or 1.8.6 (or later), which contain the fix. Consider limiting NDJSON request body sizes at the reverse proxy level.
Other vulnerabilities in Phoenix
See all- CVE-2026-56812High
A vulnerability in the Phoenix JavaScript presence client (Presence module) involves an improper existence check using a bare truthiness test (state[key]) instead of an own-property check. An attacker with ordinary channel access can choose a presence key that is an Object.prototype member name (e.g., __proto__, constructor, toString), causing the lookup to return the built-in prototype object and throw an uncaught TypeError. The flaw resides in assets/js/phoenix/presence.js in Presence.syncState and Presence.syncDiff and affects phoenix versions from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.
- CVE-2026-56811High
A vulnerability in the Phoenix.Socket module of the Phoenix framework allows an unauthenticated attacker to perform a DoS attack by sending a large number of phx_join messages over a single WebSocket or LongPoll connection. This exhausts the BEAM virtual machine process limit, blocking legitimate traffic across the entire node.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix allows a denial of service via the long-poll transport's NDJSON body handling. In 'Elixir.Phoenix.Transports.LongPoll':publish/4, when a POST request is received with Content-Type: application/x-ndjson, the request body is split on newline characters using String.split/2 with no limit on the number of resulting segments. An attacker can send a body consisting entirely of newline bytes, causing a 1:1 amplification into a list of empty binaries — a 1 MB body produces approximately one million list elements, an 8 MB body approximately 8.4 million. Each element is then walked by Enum.map, materializing another list of the same size. This exhausts BEAM memory and schedulers, crashing the node and terminating all active sessions. A session token required to reach the vulnerable endpoint is freely obtainable by any client via an unauthenticated GET request to the same URL with a matching Origin header, making this attack effectively unauthenticated. This issue affects phoenix: from 1.7.0 before 1.7.22 and 1.8.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS