{"id":"EUVD-2025-202180","revision":"ef900a93cf5a4644b677de0a2d186659","records":[{"revision":"ef900a93cf5a4644b677de0a2d186659","observedAt":"2026-10-30T01:00:04.251+00:00","statement":{"source":"euvd","id":"EUVD-2025-202180","aliases":["CVE-2025-66456","GHSA-hxj9-33pp-j2cc"],"title":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results o…","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.1,"severity":null}],"references":["https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc","https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf","https://github.com/elysiajs/elysia/pull/1564","https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e","https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-202180","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 9, 2025, 7:43:10 PM","dateUpdated":"Dec 9, 2025, 8:35:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-202180","identifiers":["EUVD-2025-202180","CVE-2025-66456","GHSA-hxj9-33pp-j2cc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}