En bref
- CVE-2026-31865 est une vulnérabilité MOYENNE (CVSS 5.3) touchant elysia (elysiajs), elysia.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.24%, plus élevée que 15.2% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.27 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| elysia | < 1.4.27
| 1.4.27
|
| elysia npm | < 1.4.27
| 1.4.27
|
Description
Impact
Elysia cookie can be overridden by prototype pollution , eg. __proto__
Sending cookie with the follows name can override cookie value:
__proto__=%7B%22injected%22%3A%22polluted%22%7D
Patches
Patched by 1.4.27
Workarounds
- Use t.Cookie validation to enforce validation value
- Prevent iterable over cookie if possible
NVD description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free