CVE-2026-31865

Published: Mar 18, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

Affected (1)

Products: Elysiajs: Elysia

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Elysiajs Elysia	Before 1.4.27

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (2)

https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab

Source: security-advisories@github.com

Patch

https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp

Source: security-advisories@github.com

MitigationPatchVendor Advisory

Timeline

No history available yet.