CVE-2025-66457
1 advisory.
npm/elysia CVE-2025-66457: high
Elysia affected by arbitrary code injection through cookie config
Action: Upgrade elysia to 1.4.18 or later.
npm i elysia@1.4.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.18 | - |
Fixed versions
| 1.4.18 |
Sources
- osv: GHSA-8vch-m3f4-q8jf
- https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf
- https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc
- https://nvd.nist.gov/vuln/detail/CVE-2025-66457
- https://github.com/elysiajs/elysia/pull/1564
- https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e
- https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e
- https://github.com/elysiajs/elysia
- https://github.com/sportshead/elysia-poc
CVE-2025-66457 · published · modified · JSON