Em resumo
- CVE-2026-31865 é uma vulnerabilidade MÉDIO (CVSS 5.3) que afeta elysia (elysiajs), elysia.
- Chance de exploração nos próximos 30 dias (EPSS): 0.24%, maior que 15.2% das vulnerabilidades.
- Correção: atualize para 1.4.27 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| elysia | < 1.4.27
| 1.4.27
|
| elysia npm | < 1.4.27
| 1.4.27
|
Description
Impact
Elysia cookie can be overridden by prototype pollution , eg. __proto__
Sending cookie with the follows name can override cookie value:
__proto__=%7B%22injected%22%3A%22polluted%22%7D
Patches
Patched by 1.4.27
Workarounds
- Use t.Cookie validation to enforce validation value
- Prevent iterable over cookie if possible
NVD description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free