CVE-2026-31865 MEDIUM

CVE-2026-31865: Elysia Cookie Value Prototype Pollution

Vendor Elysiajs
Product elysia
Weakness CWE-1321
Published March 18, 2026
Last update March 18, 2026

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

Key dates

02Disclosure timeline

March 18, 2026 CVE published
March 18, 2026 Record updated