CVE-2026-56669CWE-407CWE-436

Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.5th percentile
Weaknesses
CWE-407 · Inefficient Algorithmic Complexity; CWE-436 · Interpretation Conflict
Published
2026-07-08T20:25Z
EPSS history
Timeline
  • 08 JUL 20:25Z
    Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
    cvelistv5