CVE-2025-66456
December 09, 2025
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in "mergeDeep" after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the "__proto__ prop" to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the "__proto__ key" from body.
Affected Packages
https://github.com/elysiajs/elysia.git (GITHUB):
Affected version(s) >=0.1 <1.4.17Fix Suggestion:
Update to version 1.4.17elysia (NPM):
Affected version(s) >=1.4.0 <1.4.17Fix Suggestion:
Update to version 1.4.17Related Resources (8)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS
Base Score:
0.15
