PT-2026-25974 · Elysiajs+1 · Elysia

Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-31865

NVD

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. proto. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-31865

GHSA-8HQ9-PHH3-P2WP

Affected Products

Elysia

References · 5

• https://osv.dev/vulnerability/GHSA-8hq9-phh3-p2wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31865 · Security Note
• https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp · Note
• https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab · Note
• https://github.com/elysiajs/elysia · Note