{"id":"CVE-2025-66456","aliases":["EUVD-2025-202180","GHSA-hxj9-33pp-j2cc"],"status":"published","title":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","severity":{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00601,"percentile":0.49205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2025-12-09T17:11:53Z","modified":"2026-11-11T10:30:49Z","fixes":[{"ecosystem":"npm","package":"elysia","fixed_in":["1.4.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"elysia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.17"}]}]},{"source":"osv","ecosystem":"npm","package":"elysia","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.4.17"}]}]}],"products":[{"vendor":"elysiajs","product":"elysia"}],"references":[{"url":"https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc","tags":["x_refsource_CONFIRM","exploit","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf","tags":["x_refsource_MISC","exploit","Not Applicable","advisory","web"]},{"url":"https://github.com/elysiajs/elysia/pull/1564","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/sportshead/elysia-poc","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66456","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hxj9-33pp-j2cc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66456.json","tags":["advisory"]},{"url":"https://github.com/elysiajs/elysia","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-66456","title":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","status":"published","published":"2025-12-09T19:43:10.252Z","modified":"2025-12-09T20:35:44.683Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-202180","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","status":"published","published":"2025-12-09T19:43:10Z","modified":"2025-12-09T20:35:44Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"ghsa":[{"id":"GHSA-hxj9-33pp-j2cc","title":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","description":"Prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an `any` type that is set as a `standalone` guard, to allow for the `__proto__` prop to be merged.\n\nWhen combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker.\n\n### Impact\nRoutes with more than 2 standalone schema validation, eg. zod\n\nExample vulnerable code:\n```typescript\nimport { Elysia } from \"elysia\"\nimport * as z from \"zod\"\n\nconst app = new Elysia()\n\t.guard({\n\t\tschema: \"standalone\",\n\t\tbody: z.object({\n\t\t\tdata: z.any()\n\t\t})\n\t})\n\t.post(\"/\", ({ body }) =\u003e ({ body, win: {}.foo }), {\n\t\tbody: z.object({\n\t\t\tdata: z.object({\n\t\t\t\tmessageId: z.string(\"pollute-me\"),\n\t\t\t})\n\t\t})\n\t})\n```\n\n### Patches\nPatched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564)\n\nReference commit:\n- https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e\n- https://github.com/elysiajs/elysia/pull/1564/commits/3af978663e437dccc6c1a2a3aff4b74e1574849e\n\n### Workarounds\nRemove `__proto__` key from body\n\nExample plugin for removing `__proto__` from body\n\n```typescript\nnew Elysia()\n\t.onTransform(({ body, headers }) =\u003e {\n\t\tif (headers['content-type'] === 'application/json')\n\t\t\treturn JSON.parse(JSON.stringify(body), (k, v) =\u003e {\n\t\t\t\tif (k === '__proto__') return\n\n\t\t\t\treturn v\n\t\t\t})\n\t})\n```","status":"published","published":"2025-12-09T17:11:53Z","modified":"2025-12-09T21:37:10Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-66456","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","status":"published","published":"2025-12-09T20:15:54.76Z","modified":"2026-10-14T21:10:00.183Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:11:49.468427Z"}],"osv":[{"id":"CVE-2025-66456","title":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","status":"published","published":"2025-12-09T19:43:10.252Z","modified":"2026-11-11T10:30:49.84331473Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-11T11:06:36.179338Z"},{"id":"GHSA-hxj9-33pp-j2cc","title":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","description":"Prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an `any` type that is set as a `standalone` guard, to allow for the `__proto__` prop to be merged.\n\nWhen combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker.\n\n### Impact\nRoutes with more than 2 standalone schema validation, eg. zod\n\nExample vulnerable code:\n```typescript\nimport { Elysia } from \"elysia\"\nimport * as z from \"zod\"\n\nconst app = new Elysia()\n\t.guard({\n\t\tschema: \"standalone\",\n\t\tbody: z.object({\n\t\t\tdata: z.any()\n\t\t})\n\t})\n\t.post(\"/\", ({ body }) =\u003e ({ body, win: {}.foo }), {\n\t\tbody: z.object({\n\t\t\tdata: z.object({\n\t\t\t\tmessageId: z.string(\"pollute-me\"),\n\t\t\t})\n\t\t})\n\t})\n```\n\n### Patches\nPatched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564)\n\nReference commit:\n- https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e\n- https://github.com/elysiajs/elysia/pull/1564/commits/3af978663e437dccc6c1a2a3aff4b74e1574849e\n\n### Workarounds\nRemove `__proto__` key from body\n\nExample plugin for removing `__proto__` from body\n\n```typescript\nnew Elysia()\n\t.onTransform(({ body, headers }) =\u003e {\n\t\tif (headers['content-type'] === 'application/json')\n\t\t\treturn JSON.parse(JSON.stringify(body), (k, v) =\u003e {\n\t\t\t\tif (k === '__proto__') return\n\n\t\t\t\treturn v\n\t\t\t})\n\t})\n```","status":"published","published":"2025-12-09T17:11:53Z","modified":"2026-02-04T03:31:17.532002Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}