Read the docs
TI-2025-40889 Aliases CVE-2025-66457GHSA-8vch-m3f4-q8jf

Elysia affected by arbitrary code injection through cookie config

Priority HIGH 68CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00807 57th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed elysia (elysiajs): 1.4.18elysia (npm): 1.4.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elysiajselysiabefore 1.4.181.4.18Patch availableCNA
—elysia (npm)before 1.4.181.4.18Patch availableGHSA-8vch-m3f4-q8jf
  • elysia Vendorelysiajs Affected before 1.4.18 Fixed in 1.4.18 Patch available CNA
  • elysia (npm) Vendor— Affected before 1.4.18 Fixed in 1.4.18 Patch available GHSA-8vch-m3f4-q8jf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elysiajs:elysia:*:*:*:*:*:node.js:*:*before 1.4.18Vulnerableelysiajs
  • cpe:2.3:a:elysiajs:elysia:*:*:*:*:*:node.js:*:* Versions before 1.4.18 Vulnerable ·elysiajs

Remediation

  • Fix · CNA elysia (elysiajs) Fixed in 1.4.18
  • Fix · GHSA-8vch-m3f4-q8jf elysia (npm) Fixed in 1.4.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66457
  2. 2026-10-03 Alias added: GHSA-8vch-m3f4-q8jf

References

Exploit 2

Patch 3

Advisory 1

Other 2

  • TI-2025-40888 Elysia vulnerable to prototype pollution with multiple standalone schema validation CVSS 4.0CRITICAL 9.1
  • TI-2026-23666 Elysia has a string URL format redos CVSS 3.1HIGH 7.5
  • TI-2026-24417 Elysia Cookie Value Prototype Pollution CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences