요약
- CVE-2026-31865은(는) elysia (elysiajs), elysia에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.2%보다 높음.
- 조치: 1.4.27 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| elysia | < 1.4.27
| 1.4.27
|
| elysia npm | < 1.4.27
| 1.4.27
|
Description
Impact
Elysia cookie can be overridden by prototype pollution , eg. __proto__
Sending cookie with the follows name can override cookie value:
__proto__=%7B%22injected%22%3A%22polluted%22%7D
Patches
Patched by 1.4.27
Workarounds
- Use t.Cookie validation to enforce validation value
- Prevent iterable over cookie if possible
NVD description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free