15 Jul 2026 · Josh Price

A busy month for BEAM security advisories

Since our last CNA write-up the Erlang Ecosystem Foundation CNA has been busy: roughly two dozen CVEs in the last month, several in packages almost every Elixir web app depends on. Below they're grouped by package and ordered by severity (CVSS), worst first, with the version to upgrade to. If you do one thing, run mix hex.audit.

ueberauth_apple

• CVE-2026-55954 CRITICAL 9.1: the JWT signature is checked but ID-token claims aren't, so any Apple-signed token bearing a victim's identifier can be replayed for account takeover.

  Fix Upgrade ueberauth_apple to 0.6.2. Patch this today if you offer Sign in with Apple.

phoenix

• CVE-2026-56811 HIGH 8.7: no per-connection channel-join limit, process-exhaustion DoS from a single unauthenticated connection.

• CVE-2026-56812 MEDIUM 6.3: Presence client crashes on prototype-key collisions in syncState/syncDiff.

  Fix Upgrade phoenix to 1.8.9 (or 1.7.24 / 1.6.17 / 1.5.15 on older branches).

mint

• CVE-2026-56810 HIGH 8.7: buffers an entire chunked response chunk in memory.

• CVE-2026-58229 HIGH 8.2: unbounded HTTP/1 response-header accumulation, memory-exhaustion DoS.

• CVE-2026-59246 MEDIUM 6.3: zero-length HTTP/2 CONTINUATION frames slip past the header byte-size cap.

  Fix Upgrade mint to 1.9.2. Mint sits under Finch, Req and friends, so you may pull it in transitively.

hpax

• CVE-2026-58226 HIGH 8.7: unbounded HPACK integer decoding, unauthenticated DoS.

  Fix Upgrade hpax to 1.0.4. Transitive via Bandit and Mint.

ssl (Erlang/OTP)

• CVE-2026-55950 HIGH 8.7: DTLS listener crash via a race in dtls_packet_demux.

• CVE-2026-55952 HIGH 8.2: TLS 1.3 server DoS via a malformed ClientHello pre-shared-key extension.

• CVE-2026-54891 MEDIUM 6.3: plaintext APPLICATION_DATA injected during the TLS handshake, delivered post-handshake.

• CVE-2026-54887 MEDIUM 6.3: DTLS cookie bypass during the startup window.

  Fix Upgrade Erlang/OTP to 29.0.3, 28.5.0.3, or 27.3.4.14 (whichever matches your branch). An OTP upgrade, not a Hex bump.

mdex

• CVE-2026-53426 HIGH: atom-table exhaustion DoS via JSON parse_document.

• CVE-2026-54889 MEDIUM: javascript: injection (XSS) in Quill Delta output.

• CVE-2026-54888 MEDIUM: uncontrolled recursion over deeply nested Markdown crashes the BEAM.

• CVE-2026-53429 MEDIUM: native memory leak in escaped-tag rendering.

• CVE-2026-53428 MEDIUM: unbounded allocation in highlight_lines range expansion.

• CVE-2026-53427 LOW: XSS via an unescaped highlight_lines_class code-fence attribute.

  Fix Upgrade mdex to 0.13.x (we run 0.13.3). We hit these on this very site, see the Hex 2.5 write-up.

plug

• CVE-2026-56814 MEDIUM 6.9: multipart part headers aren't charged to the :length limit, so uploads can create unbounded temp files.

• CVE-2026-56813 LOW 2.1: cookie attribute injection in Plug.Conn.Cookies.encode/2.

  Fix Upgrade plug to 1.20.3 (or 1.19.5 / 1.18.5 / 1.17.4 / 1.16.6 on older branches).

ssh (Erlang/OTP)

• CVE-2026-54886 MEDIUM 5.3: SFTP server DoS via an extended channel-data infinite loop.

• CVE-2026-53422 LOW 2.3: SFTP REALPATH path-existence oracle allows enumeration outside the configured root.

  Fix The same OTP releases as above: 29.0.3 / 28.5.0.3 / 27.3.4.14.

phoenix_live_view

• CVE-2026-58228 MEDIUM 5.1: scheme-validation bypass in Phoenix.LiveView.Utils, XSS via <.link>.

  Fix Upgrade phoenix_live_view to 1.2.7.

postgrex

• CVE-2026-58225 LOW 2.1: SQL injection via an unescaped dollar-quote in notification reconnect replay, causing DoS.

  Fix Upgrade postgrex to 0.22.3.

swoosh

• CVE-2026-54893 LOW 2.1: email-derived URL path injection in the Microsoft Graph adapter, only if you derive the sender address from untrusted input.

  Fix Upgrade swoosh to 1.26.3.

What to do

1. Run mix hex.audit. On Hex 2.5 it also flags advisories inline during mix deps.get and fails CI on a vulnerable lockfile (see the Hex 2.5 write-up).
2. Patch worst first: the CRITICAL ueberauth_apple account-takeover, then the HIGH memory-exhaustion DoS in Phoenix, Mint, hpax and OTP ssl. Update Erlang/OTP for the ssl and ssh ones.
3. Watch the EEF CNA advisory list.

Most of these are denial-of-service via unbounded memory, but the Apple auth bypass is a real account takeover and the LiveView issue is an XSS, so don't sit on those. The reassuring part: the ecosystem catalogues this properly now and the tooling surfaces it, so staying current is mostly a matter of running the audit and not ignoring it.

15 Jul 2026 · Josh Price

Optimising every image with Kip Cole's Image library

Small confession: this site was shipping about 5 MB of avatars and event photos, mostly full-size JPEGs shown at thumbnail size. Now every image is a right-sized WebP, generated at build time by Image, the libvips-backed library from Kip Cole.

There's a nice symmetry to it: Kip gave a talk at Elixir Sydney in May 2024, Fast and efficient image processing in Elixir, on exactly this topic, using libvips, Vix and Image to scale, transform and compose images fast. We're now running his library to build the very page you're reading.

What it does for us

• A mix images build step walks the image folder and writes a right-sized .webp next to each source (avatars capped at 160px, event photos at 800px). On-page images dropped from roughly 5 MB to about 900 KB.
• The OpenGraph share cards are re-encoded to lossless WebP through the same library (libvips' webpsave), taking the card set from around 26 MB to 9 MB with no loss of crispness on the text.
• It's self-contained: Vix ships a precompiled libvips, so there's nothing to install in CI.

Image is a lovely piece of the ecosystem: a clean Elixir API over a very fast C library, precompiled so it just works. If you push images around in an Elixir app, watch Kip's talk and reach for Image.

14 Jul 2026 · Josh Price

Who's building on Elixir in Australia?

We've added a list of Australian companies building on Elixir and the BEAM to the home page. It's a small thing, but a visible one: proof that there are real jobs and real production systems on the BEAM here, not just a hobby.

If your company runs Elixir, Erlang, Gleam or anything else on the BEAM, we'd love to include you. There are two other places worth getting listed, both a quick way to show your support for the ecosystem:

• The EEF company registry, where companies formally register their use of the ecosystem so the Erlang Ecosystem Foundation can point to who depends on it.

• elixir-companies.com, the community directory. Adding yourself is a pull request on the repo.

Getting on these lists helps people find BEAM work locally and makes the community a little more visible. Tell us at a meetup or drop us a line and we'll add you to the Sydney list too.

29 Jun 2026 · Josh Price

Hex 2.5 hardens the supply chain

Hex 2.5 landed on 29 June 2026 with one theme: making it harder for a compromised release to reach your build. Supply chain attacks on package registries have become routine. The usual pattern is that someone compromises a maintainer account or a build pipeline, publishes a tampered release, and automated tooling pulls it into thousands of projects within hours, long before anyone notices. Hex 2.5 ships three layers of defence, most of which need no configuration.

Advisories in the terminal

mix deps.get and mix deps.update now flag known-vulnerable packages inline, tagging them "VULNERABLE" with a short summary and deduplicating advisories across databases. It is exactly how we recently caught and cleared a handful of advisories on this very site. Resolving deps looks like this now:

Resolving Hex dependencies...
Resolution completed in 0.42s
  mdex 0.11.7 VULNERABLE!
    EEF-CVE-2026-54889 (MEDIUM)
    aka: CVE-2026-54889, GHSA-4383-7xfp-gpph
    Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
    https://osv.dev/vulnerability/EEF-CVE-2026-54889
    EEF-CVE-2026-53426 (HIGH)
    aka: CVE-2026-53426, GHSA-923r-7vf4-5vw8
    Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
    https://osv.dev/vulnerability/EEF-CVE-2026-53426
Found packages with security advisories

For CI, mix hex.audit inspects your lockfile and exits non-zero if any dependency carries an advisory or has been retired, so a vulnerable release fails the build instead of slipping through:

$ mix hex.audit
Advisories:
  phoenix_live_view 1.2.6 - EEF-CVE-2026-58228 (MEDIUM)
    aka: CVE-2026-58228, GHSA-5cgh-g58j-m9cq
    Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
    https://osv.dev/vulnerability/EEF-CVE-2026-58228

Found packages with security advisories

Bumping phoenix_live_view to a patched release and re-running it prints "No retired or security advisory packages found", and the build is green again. This is all on for every project with nothing to configure.

Release-age cooldown

The cooldown withholds very recently published versions from resolution, giving the community time to catch a bad release before it lands in your deps:

# mix.exs
hex: [cooldown: "7d"]

Durations look like 7d, 2w or 1mo. It never touches already-locked dependencies, and there is an escape hatch when a current version turns out to be unsafe. mix hex.outdated shows which updates are being held and when they become eligible.

Dependency policies

Organisations can publish a signed policy and enforce it across every project that opts in, restricting releases by advisory severity, retirement reason, or release age. mix hex.policy show summarises the active policy, and mix hex.policy why <package> explains, version by version, why something is blocked.

Package authors need do nothing for any of this. Consumers get the advisories and the cooldown for free, which is a rare thing in security: a genuine improvement you pick up just by upgrading.

The advisories Hex surfaces are published by the Erlang Ecosystem Foundation CNA, which has been busy lately. Watch it, run mix hex.audit, and keep your dependencies current: most of these fixes are one mix deps.update away. We rounded up the last month's advisories here.