Packages / elysia / Security

ModerateVulnerabilityGHSA-8hq9-phh3-p2wpCVE-2026-31865Published 17 Mar 2026

Elysia Cookie Value Prototype Pollution

Your version

Affected releases · elysia

  • 1.x1.0.0 – 1.4.26Fixed in 1.4.27
  • 0.8.x and older0.1.0 – 0.8.17No fix, no longer updated

On 1.x, the newest line:

npm install elysia@1.4.27
Every release on a timeline
1.x

  1. Affected

    1.0.0 – 1.4.26

    130 releases

  2. Fixed

    1.4.27 – 1.4.30

    4 releases, latest

0.x

  1. Affected

    0.1.0 – 0.8.17

    132 releases

266 stable releases of elysia, oldest to newest, one row per major.

What happens

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

  1. Use t.Cookie validation to enforce validation value

  2. Prevent iterable over cookie if possible