{"id":"CVE-2026-56669","aliases":["GHSA-9643-4qgh-g8mx"],"title":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","summary":"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict","severity":"high","cvss":7.5,"cwe":["CWE-407","CWE-436"],"vendor":"elysia","product":"elysia","ecosystem":"npm","affected":["elysia < 1.4.29"],"patched":["elysia 1.4.29"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T21:54:51Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9643-4qgh-g8mx","references":[{"url":"https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56669"},{"url":"https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329"},{"url":"https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9"},{"url":"https://github.com/elysiajs/elysia/releases/tag/1.4.29"},{"url":"https://github.com/advisories/GHSA-9643-4qgh-g8mx"}],"tags":["ghsa","npm"],"epss":0.0063,"epssPercentile":0.47904,"ingestedAt":"2026-09-23T22:33:56.541Z","slug":"CVE-2026-56669","body":"## Overview\n\nElysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.\n\nElysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the form data. Because there are `n` unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan `n` x `n` key-value pairs.\n\n### Impact\nEndpoints using `multipart/form-data`\n\n### Patches\n1.4.29\n\n### Workarounds\nno 100% confirm workaround beside updating the patch\n\n## Affected packages\n\n- `elysia < 1.4.29`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `elysia 1.4.29`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}