Denial of Service in Elysia Framework

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-56669

Affected Vendors & Products

Vendor	Product	Version / Range
elysia	elysia	1.4.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Elysia Typescript framework prior to version 1.4.29. It involves the use of the getAll method in form data normalization for multipart/form-data endpoints. The way getAll is used causes the amount of work to grow quadratically with the number of unique key-value pairs submitted, which can lead to excessive CPU usage and exhaustion.

Impact Analysis

The vulnerability can lead to CPU exhaustion on systems running vulnerable versions of the Elysia framework. This means that an attacker could potentially cause a denial of service by sending specially crafted multipart/form-data requests with many unique key-value pairs, overwhelming the server's processing capacity.

Mitigation Strategies

To mitigate this vulnerability, upgrade Elysia to version 1.4.29 or later, where the issue with getAll in form data normalization for multipart/form-data endpoints has been fixed.

Hi! I’m here to help you understand CVE-2026-56669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70