CVE-2025-66456
1 advisory.
npm/elysia CVE-2025-66456: critical, EPSS 0.56%
Elysia vulnerable to prototype pollution with multiple standalone schema validation
Action: Upgrade elysia to 1.4.17 or later.
npm i elysia@1.4.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.0 | 1.4.17 | - |
Fixed versions
| 1.4.17 |
Sources
- osv: GHSA-hxj9-33pp-j2cc
- https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf
- https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc
- https://nvd.nist.gov/vuln/detail/CVE-2025-66456
- https://github.com/elysiajs/elysia/pull/1564
- https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e
- https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e
- https://github.com/elysiajs/elysia
- https://github.com/sportshead/elysia-poc
CVE-2025-66456 · published · modified · JSON