Homepage

org.webjars.npm:phoenix@1.7.21

  • latest version

    1.8.5

  • first published

    1 months ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:phoenix package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    org.webjars.npm:phoenix is a The official JavaScript client for the Phoenix web framework.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Elixir.Phoenix.Transports.LongPoll POST requests handling with Content-Type: application/x-ndjson. An attacker can exhaust system memory and schedulers, leading to a crash and termination of all active sessions by sending a large request body consisting entirely of newline bytes, which is split into a massive list of empty binaries and further processed without limits.

    Note:

    1. This is only exploitable if the longpoll transport is enabled on any Phoenix.Socket declaration, including the LiveView /live socket.

    2. Longpoll is enabled for newly generated Phoenix projects since Phoenix 1.7.11.

    How to fix Allocation of Resources Without Limits or Throttling?

    A fix was pushed into the master branch but not yet published.

    [0,)
    Go back to all versions of this package