Vulnerability advisory

GHSA-628h-q48j-jr6q

Phoenix: Long-poll NDJSON body splitting causes large memory allocation

Published May 8, 2026Updated May 8, 2026OSV record ↗

Also known as CVE-2026-32689EEF-CVE-2026-32689

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected versions

phoenix Hex

All phoenix advisories →

Affected	Fixed in
`1.7.0` to before 1.7.22	`1.7.22`Advisories →
Also listed as affected (22) `1.7.0` `1.7.1` `1.7.10` `1.7.11` `1.7.12` `1.7.13` `1.7.14` `1.7.15` `1.7.16` `1.7.17` `1.7.18` `1.7.19` `1.7.2` `1.7.20` `1.7.21` `1.7.3` `1.7.4` `1.7.5` `1.7.6` `1.7.7` `1.7.8` `1.7.9`
`1.8.0` to before 1.8.6	`1.8.6`Advisories →
Also listed as affected (6) `1.8.0` `1.8.1` `1.8.2` `1.8.3` `1.8.4` `1.8.5`

Description

Summary

An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of concurrent requests can be sufficient to let the node run out of memory.

Details

The unoptimised code path exists on the application/x-ndjson POST handling in the LongPoll transport. The endpoint requires only a session token, which any client can obtain by issuing a GET to the same URL with a matching Origin header, so exploitation is unauthenticated.

Impact

Anyone who runs a LiveView app with a public Longpoll socket or uses a Phoenix.Socket with longpoll option. Longpoll has been enabled for newly generated Phoenix projects since Phoenix 1.7.11.