CVE-2026-56669 — Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data…
Published: 2026-07-08 · CVSS: 7.5 · CVSS 3.1
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7