Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2025-66456: Elysia framework can let attackers run code
CVE-2025-66456 · published 11 months ago
Summary
Versions 1.4.0 through 1.4.16 of the Elysia request‑validation framework can be tricked into altering internal JavaScript objects, which can let an attacker execute arbitrary code on your server. Upgrade to version 1.4.17 or later as soon as possible. As a temporary measure, make sure any incoming data does not contain a "__proto__" field.
What to do
- Update GitHub Actions elysia to version 1.4.17.
- Update elysiajs elysia to version 1.4.17 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | elysia |
>= 1.4.0, < 1.4.17 Fix: upgrade to 1.4.17
|
| – | elysiajs | elysia |
>= 1.4.0, < 1.4.17 cpe:2.3:a:elysiajs:elysia:*:*:*:*:*:node.js:*:* |
Original advisory text
Elysia vulnerable to prototype pollution with multiple standalone schema validation
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
References
- https://github.com/sportshead/elysia-poc
- https://github.com/advisories/GHSA-hxj9-33pp-j2cc
- https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf Vendor Advisory
- https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66456 Vendor Advisory
- https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb5... Patch
- https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e157484... Patch
- https://github.com/elysiajs/elysia/pull/1564 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66456... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-1321Prototype Pollution
Timeline
Published9 Dec 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta