{"id":"EUVD-2026-42394","enisaUuid":"7df0337f-be8f-3556-9eb8-ab6947ff58d9","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","datePublished":"Jul 8, 2026, 8:25:18 PM","dateUpdated":"Jul 10, 2026, 3:02:07 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx\nhttps://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329\nhttps://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9\nhttps://github.com/elysiajs/elysia/releases/tag/1.4.29\n","aliases":"CVE-2026-56669\nGHSA-9643-4qgh-g8mx\n","assigner":"GitHub_M","epss":0.63,"enisaIdProduct":[{"id":"eaadf77b-b683-34e8-bad1-69f23458e70e","product":{"name":"elysia","vendor":{"name":"elysiajs"}},"product_version":"\u003c 1.4.29"}],"enisaIdVendor":[{"id":"580aa500-36df-3482-9727-24305691aaeb","vendor":{"name":"elysiajs"}}],"enisaIdVulnerability":[{"id":"380f4681-b0b5-3a7d-8be5-5483a89034e5","vulnerability":{"id":"GHSA-9643-4qgh-g8mx","description":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","datePublished":"Sep 23, 2026, 9:54:50 PM","dateUpdated":"Sep 23, 2026, 9:54:50 PM","baseScore":0.0,"references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56669\nhttps://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329\nhttps://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9\nhttps://github.com/elysiajs/elysia\nhttps://github.com/elysiajs/elysia/releases/tag/1.4.29\n","enisa_id":"EUVD-2026-42394\n","aliases":"GHSA-9643-4qgh-g8mx\nCVE-2026-56669\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8f8801d5-f9d9-3cd7-8457-17a82cb63b68","vulnerability":{"id":"CVE-2026-56669","description":"Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.","datePublished":"Jul 8, 2026, 8:25:18 PM","dateUpdated":"Jul 10, 2026, 3:02:07 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx\nhttps://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329\nhttps://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9\nhttps://github.com/elysiajs/elysia/releases/tag/1.4.29\n","enisa_id":"EUVD-2026-42394\n","assigner":"GitHub_M","epss":0.63,"dataProcessed":"Oct 30, 2026, 7:17:17 AM","vulnerabilityProduct":[{"id":"85494f3b-db1b-30b3-b73d-897322a9d790","product":{"name":"elysia","vendor":{"name":"elysiajs"}},"product_version":"\u003c 1.4.29"}],"vulnerabilityVendor":[{"id":"7cd6e30f-d9f0-3314-b084-5cd819c6f240","vendor":{"name":"elysiajs"}}]}}],"enisaIdAdvisory":[]}