CVE-2026-56669: Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-25
Weakness: CWE-407

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.

Affected products

elysiajs elysia: before 1.4.29

References

https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9
https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329
https://github.com/elysiajs/elysia/releases/tag/1.4.29
https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx

Get alerted when CVE-2026-56669 or the next vulnerability affects your stack