Medium, CVSS 6.3npmPublished
Phoenix: Presence keys colliding with Object.prototype members break existence checks
CVE-2026-56812 · GHSA-63mc-hw7g-86rr
- Affected
- npm phoenix >= 1.2.0-rc.0, < 1.5.15; >= 1.6.0-rc.0, < 1.6.17; >= 1.7.0-rc.0, < 1.7.24; >= 1.8.0-rc.0, < 1.8.9
- Fixed in
- 1.6.171.8.91.7.241.5.15· Vendor fix available
- Issue
- The Phoenix JavaScript presence client (assets/js/phoenix/presence.js) tests whether a presence already exists using a bare truthiness check (state[key]) rather than an own-property check. Because applications commonly track presences under a client-supplied username or id, the presence key can be attacker-controlled. A user who joins a channel and picks a key that names an Object.prototype member (proto, constructor, toString, hasOwnProperty, and similar) makes the lookup return the inherited Object.prototype object instead of undefined, which is truthy. The code then reads .metas.map(...) off it and throws an uncaught TypeError, breaking presence sync for every viewer of that channel topic. Any authenticated channel participant can trigger it. Details The victim is any browser subscribed to a presence channel. When it receives the server's presencestate message, it invokes Presence.syncState, which iterates the incoming presences and checks whether each one already exists…
Recommended action: Upgrade to 1.8.9, 1.7.24, 1.6.17 or 1.5.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.