← Vulnerability feed

Vulnerability record · CVE-2026-31865 · published 18 March 2026

CVE-2026-31865: Elysiajs elysia prototype pollution vulnerability

Elysiajs · Elysia

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

5.3 CVSS 3.1 Medium EPSS 0.31% · top 78.7% CWE-1321 · Prototype pollution
5.3CVSS 3.1 base score
0.31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab Patch
https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp MitigationPatchVendor Advisory

Track CVE-2026-31865 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2025-66456Elysiajs elysia prototype pollution vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 throug…EPSS 0.56%7.5CVE-2026-30837Elysiajs elysia inefficient regular expression (redos) vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.S…EPSS 0.52%7.5CVE-2025-66457Elysiajs elysia code injection vulnerabilityElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and b…EPSS 0.81%8.6CVE-2026-34621Adobe Acrobat Reader prototype pollution leads to code executionAdobe Acrobat and Reader (versions 24.001.30356, 26.001.21367 and earlier) are affected by prototype pollution (CWE-1321) that can result in arbitrar…KEVEPSS 2.2%analysed

Source: NIST National Vulnerability Database (record CVE-2026-31865), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.