CVE-2026-31865

The record

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

Affected packages

Related vulnerabilities

• GHSA-8hq9-phh3-p2wp Elysia Cookie Value Prototype Pollution Same vulnerability
• CVE-2026-30837 Elysia is a Typescript framework for request validation, type inference, OpenAPI… Also affects elysia
• GHSA-f45g-68q3-5w8x Elysia has a string URL format ReDoS Also affects elysia
• CVE-2025-66457 Elysia affected by arbitrary code injection through cookie config Also affects elysia
• CVE-2025-66456 Elysia vulnerable to prototype pollution with multiple standalone schema validation Also affects elysia
• GHSA-8vch-m3f4-q8jf Elysia affected by arbitrary code injection through cookie config Also affects elysia
• GHSA-hxj9-33pp-j2cc Elysia vulnerable to prototype pollution with multiple standalone schema validation Also affects elysia
• CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-1321