Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the n key-value pairs in the form data. Because there are n unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan n x n key-value pairs. Impact Endpoints using multipart/form-data Patches 1.4.29 Workarounds no 100% confirm workaround beside updating the patch
Recommended action: Upgrade to 1.4.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Elysia cookie can be overridden by prototype pollution , eg. proto Sending cookie with the follows name can override cookie value: Patches Patched by 1.4.27 Workarounds 1. Use t.Cookie validation to enforce validation value 2. Prevent iterable over cookie if possible
Recommended action: Upgrade to 1.4.27 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact t.String({ format: 'url' }) is vulnerable to redos Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly Here's a table demonstrating how long it takes to process repeated partial url format | n repeat | elapsedms | | --- | --- | | 1024 | 33.993 | | 2048 | 134.357 | | 4096 | 537.608 | | 8192 | 2155.842 | | 16384 | 8618.457 | | 32768 | 34604.139 | Patches Patched by 1.4.26, please kindly update elysia to = 1.4.26 Here's how long it takes after the patch | n repeat | elapsedms | | --- | --- | | 1024 | 0.194 | | 2048 | 0.274 | | 4096 | 0.455 | | 8192 | 0.831 | | 16384 | 1.632 | | 32768 | 3.052 | Workarounds 1. It's recommended to always limit URL format to a reasonable length 2. If a long URL format is necessary, to patch this without updating to 1.4.26, add the following code to any part of your codebase
Recommended action: Upgrade to 1.4.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, as it requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). However when combined with GHSA-hxj9-33pp-j2cc, this vulnerability allows for a full RCE chain. Impact - aot enabled (default) - cookie schema passed to route - Cookie config controllable eg. via env Example of vulnerable code POC: https://github.com/sportshead/elysia-poc Patches Patched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564) Reference commit: - https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e -…
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the proto prop to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. Impact Routes with more than 2 standalone schema validation, eg. zod Example vulnerable code: Patches Patched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564) Reference commit: - https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e - https://github.com/elysiajs/elysia/pull/1564/commits/3af978663e437dccc6c1a2a3aff4b74e1574849e Workarounds Remove proto key from body Example plugin for removing proto from body
Recommended action: Upgrade to 1.4.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.