← Vulnerability feed

Vulnerability record · CVE-2025-66456 · published 9 December 2025

CVE-2025-66456: Elysiajs elysia prototype pollution vulnerability

Elysiajs · Elysia

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.

9.1 CVSS 4.0 Critical EPSS 0.56% · top 55.6% CWE-1321 · Prototype pollution
9.1CVSS 4.0 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e Patch
https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e Patch
https://github.com/elysiajs/elysia/pull/1564 Issue TrackingPatch
https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf Not Applicable
https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc ExploitPatchVendor Advisory
https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf Not Applicable
https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc ExploitPatchVendor Advisory

Track CVE-2025-66456 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-30837Elysiajs elysia inefficient regular expression (redos) vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.S…EPSS 0.52%7.5CVE-2025-66457Elysiajs elysia code injection vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and b…EPSS 0.81%5.3CVE-2026-31865Elysiajs elysia prototype pollution vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4…EPSS 0.31%8.6CVE-2026-34621Adobe Acrobat Reader prototype pollution leads to code executionAdobe Acrobat and Reader (versions 24.001.30356, 26.001.21367 and earlier) are affected by prototype pollution (CWE-1321) that can result in arbitrar…KEVEPSS 2.2%analysed

Source: NIST National Vulnerability Database (record CVE-2025-66456), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.