Bandit EUVD-2026-26715

Upgrade to Bandit version 1.11.0 or later, which introduces the max_fragmented_message_size configuration option with a safe default of 8MB (commit 21612c7c7b1ce43eccd36d3af3a2299d23513667 available at https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667). Update dependencies in mix.exs with {:bandit, "~> 1.11"} and run mix deps.update bandit. The patch modifies lib/bandit/websocket/connection.ex to track cumulative fragment size via IO.iodata_length(data) and rejects messages exceeding the threshold with WebSocket close code 1009 (message too big). Organizations can tune the limit via websocket_options: [max_fragmented_message_size: bytes] in endpoint configuration; set to 0 to disable (not recommended for internet-facing services). If immediate upgrade is not feasible, implement compensating controls: (1) Deploy a reverse proxy (nginx, HAProxy) with websocket_max_message_size directive to enforce message limits before traffic reaches Bandit; note this requires proxy WebSocket protocol awareness and may add latency. (2) Use network-level rate limiting to restrict WebSocket frame rate per client IP, limiting attack velocity; this reduces but does not eliminate risk as a single slow connection can still accumulate unbounded data. (3) For Phoenix applications, temporarily disable WebSocket transport in endpoint.ex with websocket: false if real-time features are non-critical; this breaks LiveView and Channels functionality. All workarounds have operational trade-offs compared to patching.