CVE-2025-50864 Details
Description
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation.
A vulnerability in the Elysia CORS library, affecting versions through 1.3.0, allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library improperly validates the origin by checking for substrings within the CORS policy domains, instead of requiring an exact match. This flaw can be exploited by malicious origins to gain unauthorized access to user data on affected sites.
Users can update to Elysia CORS library version 1.3.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 20, 2025CISA-ADP
Assessed Aug 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts | [email protected] | Source CodeVendor |
| https://github.com/elysiajs/elysia-cors/commit/9b9eb92e32a7a4b43b6d5108668941701c33e221 | [email protected] | |
| https://github.com/elysiajs/elysia-cors/tree/main | [email protected] | Source CodeVendor |
| https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a | [email protected] | ExploitRemedyTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| elysia-cors | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 26, 2026 | CVE Modified | [email protected] |
| Aug 21, 2025 | CVE Modified | CISA-ADP |
| Aug 20, 2025 | New CVE Received | [email protected] |