HIGH 7.5 GitHub
CVE-2026-56669
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.
Elysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the for
Affected Products
- npm/elysia < 1.4.29
References
- https://github.com/advisories/GHSA-9643-4qgh-g8mx
- https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56669
- https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-23 via GitHub. Affected: npm/elysia < 1.4.29.
vulnfeed aggregates 12908 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.