CVE-2026-31865 Details
Description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
A prototype pollution vulnerability has been identified in the Elysia framework, prior to version 1.4.27. This issue allows for the manipulation of cookie values by injecting properties into the cookie's prototype, which can be exploited by sending a specially crafted cookie header. The vulnerability arises from insufficient validation of cookie values, enabling attackers to overwrite existing cookie properties or introduce new ones.
Users can upgrade to Elysia version 1.4.27 or later, where this vulnerability has been patched. As an additional measure, use the framework's cookie validation features to enforce proper validation of cookie values and prevent iteration over cookie properties if possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab | [email protected] | Patch |
| https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| elysiajs elysia | < 1.4.27 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |