GHSA-8hq9-phh3-p2wpMediumCVSS 6.5

Elysia Cookie Value Prototype Pollution

Published
March 17, 2026
Last Modified
March 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-31865 →

📋 Description

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

  1. Use t.Cookie validation to enforce validation value
  2. Prevent iterable over cookie if possible

🎯 Affected products1

  • npm/elysia:< 1.4.27

🔗 References (4)