GHSA-8hq9-phh3-p2wp | elysiajs/elysia Security | GitStock

GHSA ID: GHSA-8hq9-phh3-p2wp
CVE ID: CVE-2026-31865
Severity: medium
Published: 2026-03-17T16:17:41Z
Updated: 2026-03-22T04:26:33Z
CVSS: 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v3: 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

Use t.Cookie validation to enforce validation value
Prevent iterable over cookie if possible

CWEs

CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

References