CVE-2026-31865: Elysia Cookie Value Prototype Pollution
Impact Elysia cookie can be overridden by prototype pollution , eg. proto
Sending cookie with the follows name can override cookie value: bash proto=%7B%22injected%22%3A%22polluted%22%7D
Patches Patched by 1.4.27
Workarounds 1. Use t.Cookie validation to enforce validation value 2. Prevent iterable over cookie if possible
Other sources
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. proto. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31865?
CVE-2026-31865 has a moderate severity due to potential risks of prototype pollution.
How do I fix CVE-2026-31865?
To fix CVE-2026-31865, update the Elysia package to version 1.4.27 or later.
What is prototype pollution in the context of CVE-2026-31865?
Prototype pollution refers to the ability to manipulate an object's prototype, potentially allowing attackers to modify properties of objects in an application.
Which versions of Elysia are affected by CVE-2026-31865?
Versions of Elysia prior to 1.4.27 are affected by CVE-2026-31865.
What are the workarounds for CVE-2026-31865?
Implementing cookie validation can serve as a workaround until you can upgrade to a patched version.