{"id":"GHSA-9643-4qgh-g8mx","revision":"08bf19e05ae84b1b826352e2be243f9c","records":[{"revision":"08bf19e05ae84b1b826352e2be243f9c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9643-4qgh-g8mx","aliases":["CVE-2026-56669"],"title":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","description":"Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.\n\nElysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the form data. Because there are `n` unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan `n` x `n` key-value pairs.\n\n### Impact\nEndpoints using `multipart/form-data`\n\n### Patches\n1.4.29\n\n### Workarounds\nno 100% confirm workaround beside updating the patch","state":0,"publishedAt":"2026-09-23T21:54:50+00:00","modifiedAt":"2026-09-23T22:00:04.4299699+00:00","affected":[{"ecosystem":"npm","name":"elysia","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.29"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx","https://nvd.nist.gov/vuln/detail/CVE-2026-56669","https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329","https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9","https://github.com/elysiajs/elysia","https://github.com/elysiajs/elysia/releases/tag/1.4.29"],"sourceUrl":"https://github.com/advisories/GHSA-9643-4qgh-g8mx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9643-4qgh-g8mx","identifiers":["GHSA-9643-4qgh-g8mx","CVE-2026-56669"]},"retained":false,"historicalAffected":[]}],"coverage":[]}