CVE-2026-56669 json
Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
published 4mo ago modified 17d ago also EUVD-2026-42394 , GHSA-9643-4qgh-g8mx
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
Patch / fix
- npm elysia 1.4.29
- elysiajs elysia 1.4.29
Is CVE-2026-56669 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | elysia | <1.4.29 |
1.4.29 |
Affected products
- elysiajs elysia
Classification
References
-
github.com
/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329
web
-
github.com
/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx
web, advisory
-
gist.github.com
/jviide/ea040eabe7bac058326174e2cd42dfd9
web
-
github.com
/elysiajs/elysia/releases/tag/1.4.29
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-56669
advisory
-
github.com
/elysiajs/elysia
package
Sources
- CVE List CVE-2026-56669
- GitHub Advisory GHSA-9643-4qgh-g8mx
- NVD CVE-2026-56669
- Maintainer advisory GHSA-9643-4qgh-g8mx
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of elysiajs/elysia published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.