Phoenix’s long‑poll transport processes NDJSON request bodies by splitting on newline characters with no limit, allowing an attacker who can send a payload of only newline bytes to create an inordinate number of empty binaries. The resulting list grows to millions of elements for modest body sizes, exhausting BEAM memory and scheduler threads and crashing the node. This flaw, classified as CWE‑770, yields a denial of service that is effectively unauthenticated because a session token can be obtained through a public GET request with a matching Origin header.

The vulnerability impacts the Phoenix Framework, in all releases from 1.7.0 up to but not including 1.7.22, as well as version 1.8.6. Versions 1.7.22 and later, and 1.8.6 patched releases, contain the fix.

With a CVSS score of 8.7 the exploit poses a high severity risk. The EPSS score is not available, yet the straightforward, unauthenticated attack path—POSTing a crafted NDJSON payload to the exposed long‑poll endpoint—makes it highly likely that malicious actors can leverage this. The flaw is not listed in CISA’s KEV catalog. Attackers who can reach the endpoint from any network segment can trigger application crashes and disrupt all active sessions, and the denial of service can propagate across distributed deployments that share the same node instance.