Paraxial.io 2.13.0 Scans Elixir for Known Vulnerabilities

On October 29, 2026, the Elixir team released new patch versions to fix several CVEs, including CPU exhaustion in URI.parse/1 (CVE-2026-109821), oversized integers in the JSON decoder (CVE-2026-115274), and mix deps.partition on multi-user systems (CVE-2026-97209). Make sure you are running one of: 1.18.6, 1.19.7, or 1.20.5.

Paraxial.io for Elixir version 2.13.0 adds Elixir vulnerability scanning to mix paraxial.scan. Version 2.12.0 started checking the Erlang/OTP runtime. This release does the same for Elixir itself: the scan now reports the known security advisories that affect the Elixir version your project is running on, alongside the existing OTP, hex dependency, license, and Sobelow results.

Upgrading

{:paraxial, "~> 2.13"}

What the scan reports

Every scan prints the Elixir version it checked, how many advisories it checked against, and where that advisory data came from:

[Paraxial] Elixir 1.20.1, checked against 5 advisories (server data 2026-11-02T13:42:26Z)

Each matching advisory becomes a finding, worst severity first:

[Paraxial] elixir_advisory
  affected_applications: elixir
  cve_id: CVE-2026-109821
  dependency: elixir
  first_patched_version: 1.20.5
  ghsa_id: GHSA-327h-97cv-59xg
  severity: medium
  summary: Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service
  title: Elixir CVE-2026-109821
  url: https://github.com/elixir-lang/elixir/security/advisories/GHSA-327h-97cv-59xg
  version: 1.20.1

first_patched_version is the release that fixes the advisory for your version. Most Elixir advisories are fixed on every maintained branch, so a project on 1.19 is usually pointed at a 1.19 patch rather than told to move to 1.20. When a fix only shipped on a newer branch, or your version is older than any maintained branch, the finding names the first release that fixes it.

Advisories cover the applications that ship with Elixir, not just the elixir application. One of the current five is in mix, and affected_applications tells you which part of Elixir the advisory is about.

How to ignore advisories

Elixir findings use the reserved dependency name elixir in .paraxial-ignore-deps, with the same two formats as a hex dependency and as erlang_otp. To turn the Elixir check off entirely:

elixir

To ignore one advisory, by CVE or GHSA id:

elixir CVE-2026-109821

Advisory ids in your hex :ignore_advisories config are honored here too. Ignore rules are sent with the scan, so the Paraxial.io server, which re-runs the match against its own fresher data, does not bring back an advisory you chose to ignore.

Before you upgrade a CI pipeline

If you run mix paraxial.scan --add-exit-code, Elixir advisories count as findings like everything else. A project that passed yesterday can fail today. Elixir 1.20.1, for example, is affected by four of the five published advisories. That is the intended behavior, but run the scan locally first to see what your Elixir version is carrying.

---

Paraxial.io is the only security platform built specifically for Elixir and Phoenix, helping developers and agents ship secure applications. Contact us today to get started.