CVE-2026-56669
High · 7.5CVSS
7.5
EPSS
—
Published
Jul 8, 2026
CISA due date
—
The record
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result… CWE-407
- CVE-2026-112894 Pillow is a Python imaging library. CWE-407
- CVE-2026-112891 Pillow is a Python imaging library. CWE-407
- CVE-2026-112401 Pillow is a Python imaging library. CWE-407
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-407
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-407
- CVE-2026-95838 containerd is an open-source container runtime. CWE-407
- CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does… CWE-407