Skip to contentistheinternetok

Is phoenixframework/phoenix OK?

Yes.

Nothing serious in what it ships.

Internal: 5 flaws in tests and tools, none reaches your users.

Checked 17:01 UTCcommit e36472dadvisories as of 16:48 UTC

Post on X

Touches your users

18 flaws in what the project ships, the gravest first.

Can expose your users' data or let someone take over

  • plug_crypto 2.2.01 flawfixed in 2.2.1Someone could read data they should not see. Only with an account.
    • EEF-CVE-2026-105963Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
  • postgrex 0.22.31 flawfixed in 0.22.4Someone could read data they should not see. Only with access to the machine.
  • cowlib 2.19.03 flawsSomeone could attack the people who use it. From anywhere online, no account needed.
    • EEF-CVE-2026-43971Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    • EEF-CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    • EEF-CVE-2026-43969Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
  • phoenix_live_view 1.2.01 flawfixed in 1.2.9Someone could attack the people who use it. From anywhere online, no account needed.
    • EEF-CVE-2026-64941Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
  • lazy_html 0.1.111 flawfixed in 0.1.13Someone could attack the people who use it. From anywhere online, no account needed.
    • EEF-CVE-2026-92106lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

Can break or slow your service

  • bandit 1.12.44 flawsfixed in 1.13.0Someone could make it crash or freeze. From anywhere online, no account needed.
    • EEF-CVE-2026-105659HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    • EEF-CVE-2026-74836HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
    • EEF-CVE-2026-105660Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    • EEF-CVE-2026-75484HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
  • mint 1.9.36 flawsfixed in 1.10.2Someone could make it crash or freeze. From anywhere online, no account needed.
    • EEF-CVE-2026-82728Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
    • EEF-CVE-2026-82729Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
    • EEF-CVE-2026-91043HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
    • EEF-CVE-2026-92103Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
    • EEF-CVE-2026-82672Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
    • EEF-CVE-2026-94194Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
  • decimal 3.1.11 flawfixed in 3.1.2Someone could make it crash or freeze. Only with access to the machine.
    • EEF-CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Internal only

Dev tools, tests, examples, docs and benchmarks: they do not reach your users, so they never count in the answer.

  • undici 8.11.23 flawsfixed in 8.12.2Someone could change data or files. From anywhere online, no account needed.
    • GHSA-f72v-6w45-q472undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
    • GHSA-xjj6-f33q-929cundici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    • GHSA-4qv8-2p9j-2685undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
  • vue-template-compiler 2.7.161 flawSomeone could attack the people who use it. Only with an account.
  • nanoid 3.3.161 flawfixed in 3.3.18Someone could make it crash or freeze. From anywhere online, no account needed.

Email me when this changes

One email to confirm, then one only when the answer gets worse or a new serious flaw appears: at most one a day, at once if attackers use it. One click to unsubscribe.

Put the badge in your README

It shows this answer and changes with it.

Is phoenixframework/phoenix OK?
[![Is phoenixframework/phoenix OK?](https://istheinternetok.com/r/phoenixframework/phoenix/badge.svg)](https://istheinternetok.com/r/phoenixframework/phoenix/)

Read from installer/mix.lock, integration_test/mix.lock, mix.lock, package-lock.json.