Skip to content
OpenAdvisories

Vendor

elysiajs

5 known vulnerabilities.

elysiajs at a glance

Last 12 months
5
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 2 vulnerabilities, 1 critical Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202620
Feb 202600
Jan 202600
Dec 202521
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

elysia 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 7.5
    CVE-2026-56669

    Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict

    Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to gr…

    elysiajs elysia elysia npm
  • Medium 6.5
    CVE-2026-31865

    Elysia Cookie Value Prototype Pollution

    Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4…

    elysiajs elysia elysia npm
  • High 7.5
    CVE-2026-30837

    Elysia has a string URL format redos

    Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multip…

    elysiajs elysia elysia npm
  • High 7.5
    CVE-2025-66457

    Elysia affected by arbitrary code injection through cookie config

    Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there …

    elysiajs elysia elysia npm
  • Critical 9.1
    CVE-2025-66456

    Elysia vulnerable to prototype pollution with multiple standalone schema validation

    Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard sche…

    elysiajs elysia elysia npm