TI-2026-24417 Aliases CVE-2026-31865 GHSA-8hq9-phh3-p2wp

Elysia Cookie Value Prototype Pollution

LOW 34CWE-1321Published 2026-03-18 · Updated 2026-03-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix Fixed elysia (elysiajs): 1.4.27elysia (npm): 1.4.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elysiajs	elysia	before 1.4.27	1.4.27	Patch available	CNA
—	elysia (npm)	before 1.4.27	1.4.27	Patch available	GHSA-8hq9-phh3-p2wp

elysia Vendorelysiajs Affected before 1.4.27 Fixed in 1.4.27 Patch available CNA
elysia (npm) Vendor— Affected before 1.4.27 Fixed in 1.4.27 Patch available GHSA-8hq9-phh3-p2wp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elysiajs:elysia::::::node.js::*	before 1.4.27	Vulnerable	elysiajs

cpe:2.3:a:elysiajs:elysia:*:*:*:*:*:node.js:*:* Versions before 1.4.27 Vulnerable ·elysiajs

Remediation

Fix · CNA elysia (elysiajs) Fixed in 1.4.27
Fix · GHSA-8hq9-phh3-p2wp elysia (npm) Fixed in 1.4.27 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-31865
2026-10-03 Alias added: GHSA-8hq9-phh3-p2wp

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-31865

Other 1

https://github.com/elysiajs/elysia

TI-2025-40888 Elysia vulnerable to prototype pollution with multiple standalone schema validation CVSS 4.0CRITICAL 9.1
TI-2025-40889 Elysia affected by arbitrary code injection through cookie config CVSS 4.0HIGH 7.5
TI-2026-23666 Elysia has a string URL format redos CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences