{"id":"EUVD-2025-202180","enisaUuid":"4a98cc85-81bf-3e12-aa42-8c211c40005e","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","datePublished":"Dec 9, 2025, 7:43:10 PM","dateUpdated":"Dec 9, 2025, 8:35:44 PM","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc\nhttps://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf\nhttps://github.com/elysiajs/elysia/pull/1564\nhttps://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e\nhttps://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e\n","aliases":"CVE-2025-66456\nGHSA-hxj9-33pp-j2cc\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"26421537-8807-3d1d-a70c-2790026e5a12","product":{"name":"elysia","vendor":{"name":"elysiajs"}},"product_version":"1.4.0, \u003c 1.4.17"}],"enisaIdVendor":[{"id":"e326c181-a38c-323c-b6b3-2eaafefb9488","vendor":{"name":"elysiajs"}}],"enisaIdVulnerability":[{"id":"32848cd7-130e-39ac-9d25-055e1dff3044","vulnerability":{"id":"GHSA-hxj9-33pp-j2cc","description":"Elysia vulnerable to prototype pollution with multiple standalone schema validation","datePublished":"Dec 9, 2025, 5:11:53 PM","dateUpdated":"Dec 9, 2025, 9:37:06 PM","baseScore":0.0,"references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf\nhttps://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66456\nhttps://github.com/elysiajs/elysia/pull/1564\nhttps://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e\nhttps://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e\nhttps://github.com/elysiajs/elysia\nhttps://github.com/sportshead/elysia-poc\n","enisa_id":"EUVD-2025-202180\n","aliases":"GHSA-hxj9-33pp-j2cc\nCVE-2025-66456\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"64be8e1b-5d1d-38ee-b949-82fc649790a9","vulnerability":{"id":"CVE-2025-66456","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","datePublished":"Dec 9, 2025, 7:43:10 PM","dateUpdated":"Dec 9, 2025, 8:35:44 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc\nhttps://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf\nhttps://github.com/elysiajs/elysia/pull/1564\nhttps://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e\nhttps://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e\n","enisa_id":"EUVD-2025-202180\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 9, 2026, 7:20:17 AM","vulnerabilityProduct":[{"id":"aead009f-99bc-3703-8cfe-77ebc07d87c8","product":{"name":"elysia","vendor":{"name":"elysiajs"}},"product_version":"1.4.0, \u003c 1.4.17"}],"vulnerabilityVendor":[{"id":"0044e9a2-e8c5-3381-becf-15fb1e76357c","vendor":{"name":"elysiajs"}}]}}],"enisaIdAdvisory":[]}