{"id":"CVE-2026-56669","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T21:16:50.690","lastModified":"2026-10-25T17:10:00.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29."},{"lang":"es","value":"Elysia es un framework de Typescript para validación de solicitudes, inferencia de tipos, documentación OpenAPI y comunicación cliente-servidor. Antes de la versión 1.4.29, Elysia utiliza getAll en la normalización de datos de formulario para endpoints multipart/form-data, lo que provoca que la cantidad de trabajo crezca cuadráticamente con el número de pares clave-valor únicos y permite el agotamiento de la CPU. Este problema está solucionado en la versión 1.4.29."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"elysiajs","product":"elysia","versions":[{"version":"< 1.4.29","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-10T15:01:58.719561Z","id":"CVE-2026-56669","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"},{"lang":"en","value":"CWE-436"}]}],"references":[{"url":"https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9","source":"security-advisories@github.com"},{"url":"https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329","source":"security-advisories@github.com"},{"url":"https://github.com/elysiajs/elysia/releases/tag/1.4.29","source":"security-advisories@github.com"},{"url":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx","source":"security-advisories@github.com"}]}