In short
- CVE-2026-31865 is a MEDIUM (CVSS 5.3) vulnerability affecting elysia (elysiajs), elysia.
- Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 15.2% of all vulnerabilities.
- Fix: update to 1.4.27 or later.
| Package | Affected versions | Patched versions |
|---|
| elysia | < 1.4.27
| 1.4.27
|
| elysia npm | < 1.4.27
| 1.4.27
|
Description
Impact
Elysia cookie can be overridden by prototype pollution , eg. __proto__
Sending cookie with the follows name can override cookie value:
__proto__=%7B%22injected%22%3A%22polluted%22%7D
Patches
Patched by 1.4.27
Workarounds
- Use t.Cookie validation to enforce validation value
- Prevent iterable over cookie if possible
NVD description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free