CVE-2026-56669: Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Elysia (TypeScript framework)to a version that resolves this vulnerability.Fixed in 1.4.29
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56669?
CVE-2026-56669 has a high severity rating of 7.5.
What type of vulnerability is CVE-2026-56669?
CVE-2026-56669 is characterized by inefficient algorithmic complexity that can impact performance.
How do I fix CVE-2026-56669?
To fix CVE-2026-56669, update to Elysia version 1.4.29 or later.
What software is affected by CVE-2026-56669?
CVE-2026-56669 affects the Elysia framework, which is used for request validation and type inference in TypeScript.
What is the impact of CVE-2026-56669?
The impact of CVE-2026-56669 is that it can cause performance degradation under specific conditions due to inefficient handling of multipart/form-data.