Description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| elysiajs | elysia | < 1.4.29 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | elysia | < 1.4.29 | 1.4.29 | GHSA-9643-4qgh-g8mx |