CVE-2026-8469

HighCVSS 8.2

Published: 20/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

42th percentile - higher than 42% of all known CVEs

Summary

phoenix_storybook before 1.1.0 has an allocation of resources without limits vulnerability allowing unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied parameters to atoms without validation, and BEAM atoms are never garbage-collected, leading to permanent allocation and node abort when the atom table limit (~1,048,576 atoms) is reached.

Risk Assessment

An unauthenticated attacker can crash the entire BEAM node, stopping all applications running on it, leading to service disruption.

Recommendation

Upgrade phoenix_storybook to version 1.1.0 or later.

Other vulnerabilities in phoenix_storybook

CVE-2026-8467Critical
The phoenix_storybook library from version 0.5.0 before 1.1.0 contains a code injection vulnerability allowing unauthenticated remote code execution. The vulnerability is in the psb-assign WebSocket event handler, where attribute names and values from unauthenticated clients are stored without sanitization and then interpolated into a HEEx template without proper escaping. This allows injection of an Elixir expression that is compiled and executed on the server.

Original NVD description (English source)

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_set_variation_assign/3 interns every key of the psb-assign params map; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_toggle_variation_assign/3 interns the "attr" value from psb-toggle events; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_variation_id/2 interns elements of "variation_id"; and 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it. This issue affects phoenix_storybook from 0.2.0 before 1.1.0.