CVE-2026-56669: Elysia Package Suffers from Inefficient Algorithmic Complexity Leading to Denial-of-Service Vulnerability
Summary
CVE-2026-56669: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict. Affects elysia versions < 1.4.29. Fixed in 1.4.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elysia is a web framework designed for building APIs and web applications in Node.js. It is known for its simplicity and performance, allowing developers to create robust applications with minimal overhead. However, in version 1.4.28, Elysia is vulnerable to denial-of-service attacks due to inefficient handling of form data, specifically in its data normalization process.
Vulnerability Detail
The vulnerability arises from the use of the getAll method to retrieve values from FormData. This method is called directly in relation to the number of key-value pairs in the form data, leading to quadratic growth in processing time. As the number of unique key-value pairs doubles, the processing time quadruples, making the application susceptible to CPU exhaustion. This can result in denial-of-service attacks, particularly on endpoints that utilize multipart/form-data for file uploads or form submissions.
How To Fix
Latest published version: 1.4.30 as of 23 Oct 2026
npm install elysia@1.4.30Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.29
This is the first release that contains the fix.
npm install elysia@1.4.29Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no confirmed workarounds that can fully mitigate the issue without updating to the patched version. It is highly recommended to update as soon as possible to avoid potential denial-of-service attacks.
Conclusion
The Elysia package version 1.4.28 is vulnerable to denial-of-service attacks due to inefficient algorithmic complexity in its data normalization process. It is crucial to update to version 1.4.29 or later to protect your application from potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for elysia →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Elysia versions prior to 1.4.29 are affected by this vulnerability.
This vulnerability can lead to denial-of-service attacks due to CPU exhaustion, making the application unresponsive.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
There are currently no confirmed workarounds to mitigate the risk without updating to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for elysia.
