GitHub Advisoryadvisory · npm
GHSA-8hq9-phh3-p2wp Elysia Cookie Value Prototype Pollution
MEDIUM
Official page ↗
- Aliases
- CVE-2026-31865
- Ecosystem
- npm
- Packages
- elysia
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-1321
- Reviewed
- 2026-03-17
Affected packages
• npm elysia: < 1.4.27 → fixed in 1.4.27
Description
Impact
Elysia cookie can be overridden by prototype pollution , eg. `__proto__`
Sending cookie with the follows name can override cookie value:
```bash
__proto__=%7B%22injected%22%3A%22polluted%22%7D
```
Patches
Patched by 1.4.27
Workarounds
1. Use t.Cookie validation to enforce validation value
2. Prevent iterable over cookie if possible
Related
Alias · CVE (1)
- CVE-2026-31865 Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. vulnerability
Weakness · CWE (1)
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness