{"id":"CVE-2026-56669","aliases":["EUVD-2026-42394","GHSA-9643-4qgh-g8mx"],"status":"published","title":"Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0063,"percentile":0.50648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407","CWE-436"],"published":"2026-07-08T20:25:18Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"npm","package":"elysia","fixed_in":["1.4.29"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"elysia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.29"}]}]},{"source":"osv","ecosystem":"npm","package":"elysia","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.29"}]}]}],"products":[{"vendor":"elysiajs","product":"elysia"}],"references":[{"url":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329","tags":["x_refsource_MISC","fix","web"]},{"url":"https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/elysiajs/elysia/releases/tag/1.4.29","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56669","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9643-4qgh-g8mx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56669.json","tags":["advisory"]},{"url":"https://github.com/elysiajs/elysia","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-56669","title":"Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","status":"published","published":"2026-07-08T20:25:18.2Z","modified":"2026-07-10T15:02:07.512Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407","CWE-436"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-42394","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","status":"published","published":"2026-07-08T20:25:18Z","modified":"2026-07-10T15:02:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:02.822464Z"}],"ghsa":[{"id":"GHSA-9643-4qgh-g8mx","title":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.\n\nElysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the form data. Because there are `n` unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan `n` x `n` key-value pairs.\n\n### Impact\nEndpoints using `multipart/form-data`\n\n### Patches\n1.4.29\n\n### Workarounds\nno 100% confirm workaround beside updating the patch","status":"published","published":"2026-09-23T21:54:50Z","modified":"2026-09-23T21:54:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-436"],"updated_at":"2026-11-02T14:41:21.616682Z"}],"nvd":[{"id":"CVE-2026-56669","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","status":"published","published":"2026-07-08T21:16:50.69Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407","CWE-436"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-56669","title":"Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","status":"published","published":"2026-07-08T20:25:18.2Z","modified":"2026-10-28T02:31:06.864079741Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-436"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"GHSA-9643-4qgh-g8mx","title":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.\n\nElysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the form data. Because there are `n` unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan `n` x `n` key-value pairs.\n\n### Impact\nEndpoints using `multipart/form-data`\n\n### Patches\n1.4.29\n\n### Workarounds\nno 100% confirm workaround beside updating the patch","status":"published","published":"2026-09-23T21:54:50Z","modified":"2026-09-23T22:00:04.429969872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-436"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}