PT-2026-25974 · Elysia · Elysia

Ebadfd · Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-31865

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elysia versions prior to 1.4.27

Description Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. A prototype pollution issue exists in Elysia where a cookie can be overridden, specifically using the proto property. Sending a cookie with the name proto can override cookie values. This issue is addressed in version 1.4.27.

Recommendations Versions prior to 1.4.27 should be updated to version 1.4.27 or later. As a workaround, use t.Cookie validation to enforce validation of cookie values and/or prevent iteration over cookies if possible.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-31865

GHSA-8HQ9-PHH3-P2WP

Affected Products

Elysia

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31865.json · Exploit
• https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab · Patch
• https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31865 · Security Note
• https://osv.dev/vulnerability/GHSA-8hq9-phh3-p2wp · Vendor Advisory
• https://github.com/elysiajs/elysia · Note
• https://twitter.com/CVEnew/status/2034136417090036189 · Twitter Post
• https://twitter.com/cyberbivash/status/2034140255238971795 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034283516087669082 · Twitter Post
• https://twitter.com/CVEarity/status/2034177246865531358 · Twitter Post
• https://twitter.com/aibianwushi/status/2034350630652064166 · Twitter Post