p PatchFirst

CVE-2026-31865

CVE-2026-31865 · Elysia Cookie Value Prototype Pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

CVSS 6.5 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • elysia

    Versions
    • < 1.4.27: Affected

    No fix published

  • elysia npm

    Affected ranges
    • SEMVER: < 1.4.27

    Update to 1.4.27

Original sources

Check your server →