Elysiajs vulnerabilities
We track 4 vulnerabilities in Elysiajs products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.
Latest Elysiajs vulnerabilities
- 7.5 High severity
elysia: Inefficient Algorithmic Complexity
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to gro
- 7.5 High severity
elysia: Inefficient Regular Expression Complexity
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multipl
- 8.8 High severity
elysia: Improper Control of Generation of Code
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there a
- 9.8 Critical severity
elysia: Improperly Controlled Modification of Object Prototype Attributes
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schem