AIKIDO-2026-467419
ash_phoenix is vulnerable to Permissive Regular Expression
63
Medium Risk
This Affects:
ash_phoenixTL;DR
AshPhoenix.Helpers.get_subdomain/2 extracts a subdomain by interpolating the configured root host into a regex without escaping it, using an unanchored global pattern. Each dot in the root host becomes a wildcard and other metacharacters act as patterns, so the pattern matches anywhere in the Host value rather than only as a trailing suffix. A crafted or differently-cased Host header can map to an arbitrary tenant or reduce to nil to reach the root context, and can also deny service. The fix matches the root host case-insensitively and as an exact suffix.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use subdomain-based tenant selection through AshPhoenix.Helpers.get_subdomain/2 or SubdomainHook where the Host header is externally controlled.
Background info
ash_phoenix is vulnerable to Permissive Regular Expression in versions 2.1.26 - 2.3.24.
How to fix this
Upgrade the ash_phoenix library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.