CVE-2025-66456

critical

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.

Vendor / product: Elysiajs — elysia

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2025-12-09 20:15

Modified: 2026-10-14 21:10

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 07:06 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

elysiajs / elysia ≥1.4.0 <1.4.17

Weakness classification (CWE)

CWE-1321

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc

Patch / mitigation: https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e

Patch / mitigation: https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e

Patch / mitigation: https://github.com/elysiajs/elysia/pull/1564

Patch / mitigation: https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc

References

https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e security-advisories@github.com
https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e security-advisories@github.com
https://github.com/elysiajs/elysia/pull/1564 security-advisories@github.com
https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf security-advisories@github.com
https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc security-advisories@github.com
https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf 134c704f-9b21-4f2e-91b3-4a467353bcc0
https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores