phoenix 1.4.8

Direct Vulnerabilities

Known vulnerabilities in the phoenix package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Check for Unusual or Exceptional Conditions phoenix is a The official JavaScript client for the Phoenix web framework. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the `syncState` and `syncDiff` presence reconciliation code in `assets/js/phoenix/presence.js`. An attacker can crash presence updates for every browser viewing a topic by joining with a presence key such as `__proto__`, `constructor`, or `hasOwnProperty`. The vulnerable code stores presence state in plain objects and checks existing entries with `state[key]`, so a prototype-colliding key resolves to an inherited `Object.prototype` property instead of an actual presence record. When the code then reads `.metas.map(...)` from that inherited object, it throws an uncaught `TypeError`, breaking presence synchronization for that channel topic until the attacker leaves. How to fix Improper Check for Unusual or Exceptional Conditions? Upgrade `phoenix` to version 1.5.15, 1.6.17, 1.7.24, 1.8.9 or higher.	>=1.2.0-rc.0 <1.5.15>=1.6.0-rc.0 <1.6.17>=1.7.0-rc.0 <1.7.24>=1.8.0-rc.0 <1.8.9
M Origin Validation Error phoenix is a The official JavaScript client for the Phoenix web framework. Affected versions of this package are vulnerable to Origin Validation Error due to `socket/transport.ex` mishandling `check_origin` wildcarding. Note: LiveView applications are unaffected by default because of the presence of a `LiveView` CSRF token. How to fix Origin Validation Error? Upgrade `phoenix` to version 1.5.15, 1.6.14 or higher.	<1.5.15>=1.6.0-rc.0 <1.6.14

Vulnerability

Vulnerable Version

Improper Check for Unusual or Exceptional Conditions

phoenix is a The official JavaScript client for the Phoenix web framework.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the syncState and syncDiff presence reconciliation code in assets/js/phoenix/presence.js. An attacker can crash presence updates for every browser viewing a topic by joining with a presence key such as __proto__, constructor, or hasOwnProperty. The vulnerable code stores presence state in plain objects and checks existing entries with state[key], so a prototype-colliding key resolves to an inherited Object.prototype property instead of an actual presence record. When the code then reads .metas.map(...) from that inherited object, it throws an uncaught TypeError, breaking presence synchronization for that channel topic until the attacker leaves.

How to fix Improper Check for Unusual or Exceptional Conditions?

Upgrade phoenix to version 1.5.15, 1.6.17, 1.7.24, 1.8.9 or higher.

>=1.2.0-rc.0 <1.5.15>=1.6.0-rc.0 <1.6.17>=1.7.0-rc.0 <1.7.24>=1.8.0-rc.0 <1.8.9

Origin Validation Error

phoenix is a The official JavaScript client for the Phoenix web framework.

Affected versions of this package are vulnerable to Origin Validation Error due to socket/transport.ex mishandling check_origin wildcarding.

Note:

LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

How to fix Origin Validation Error?

Upgrade phoenix to version 1.5.15, 1.6.14 or higher.

<1.5.15>=1.6.0-rc.0 <1.6.14

phoenix@1.4.8

The official JavaScript client for the Phoenix web framework.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically