PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8469 phenixdigital CVE debrief

CVE-2026-8469 is a high-severity denial-of-service issue in phenixdigital phoenix_storybook. The flaw is caused by converting attacker-controlled LiveView event parameters into atoms without adequate validation, which can permanently consume BEAM atom table entries. Because atoms are not garbage-collected, repeated unique inputs can eventually exhaust the atom table and crash the BEAM node. The issue affects phoenix_storybook from 0.2.0 before 1.1.0 and is unauthenticated over network-facing LiveView handlers.

Vendor
phenixdigital
Product
phoenix_storybook
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-23
Advisory published
2026-05-20
Advisory updated
2026-07-23

Who should care

Teams running phoenix_storybook in Elixir/Phoenix applications, especially if LiveView endpoints are exposed to untrusted users. SREs and application owners should care because atom-table exhaustion can terminate the entire BEAM node, affecting all workloads on that node.

Technical summary

The vulnerability is an allocation-without-limits problem (CWE-770). Multiple LiveView event handlers in PhoenixStorybook.ExtraAssignsHelpers convert user-supplied strings to atoms with String.to_atom/1: handle_set_variation_assign/3 interns each key from psb-assign, handle_toggle_variation_assign/3 interns the attr value from psb-toggle, to_variation_id/2 interns variation_id elements, and to_value/4 interns raw string values for attributes declared as :atom or :boolean. Since BEAM atoms are permanent allocations, attacker-controlled unique strings can drive the atom table toward its ceiling and abort the node.

Defensive priority

High. This is an unauthenticated, remotely triggerable availability issue with node-wide impact, and the affected component is publicly disclosed.

Recommended defensive actions

  • Upgrade phoenix_storybook to 1.1.0 or later.
  • Review any local forks or downstream code for String.to_atom/1 on user-controlled input.
  • Replace unsafe atom conversion with allowlisted values or String.to_existing_atom/1 where appropriate.
  • Add monitoring for unusual LiveView event volume and repeated unique parameter values.
  • If atom-table exhaustion is suspected, treat the node as unstable and restore service from a clean restart after remediation.

Evidence notes

The CVE description states the vulnerability affects phoenix_storybook from 0.2.0 before 1.1.0 and identifies the unsafe atom conversion paths in ExtraAssignsHelpers. The official source set includes the ERLEF CNA record, an upstream GitHub commit, the GitHub security advisory, and an OSV entry. NVD metadata marks the record as Deferred and classifies the weakness as CWE-770.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8469 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8469

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8469 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8469

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-8469.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-8469

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.