Phoenix Framework CVE-2026-32689

Upgrade Phoenix to version 1.7.22 or 1.8.6 immediately. Patches are available from the official GitHub repository at commits 1a67c61ff9ce0a7711662ac7354861917a7c80f7 (v1.7.22) and 912ea181fd247c21dbcc49fb97d0053b947d81bf (v1.8.6). Update mix.exs dependency and run 'mix deps.update phoenix'. If immediate upgrade is not feasible, implement reverse proxy rate limiting on the /socket/longpoll endpoint: limit request body size to 1 MB and enforce rate limits of 10 requests per minute per source IP (adjust based on legitimate client behavior). Be aware that rate limiting reduces attack impact but does not eliminate the vulnerability, as even a 1 MB payload can trigger memory exhaustion on under-resourced nodes. Another compensating control is disabling long-poll transport entirely if WebSocket is supported by all clients: remove or comment out the LongPoll transport configuration in endpoint.ex socket declarations. This breaks compatibility with clients in restrictive network environments (corporate proxies blocking WebSocket) but eliminates the attack vector. Monitor BEAM memory and scheduler utilization via :observer or external APM tools; set alerts for sustained >80% memory usage as an early warning signal. The patch enforces client-side batching (100 messages per POST) and replaces eager String.split/2 with lazy String.splitter/2, but server-side validation remains a TODO per commit comments, so layered defenses are prudent. Full advisory and patch details at https://github.com/phoenixframework/phoenix/security/advisories/GHSA-628h-q48j-jr6q.