---
id: CVE-2026-56669
aliases:
  - GHSA-9643-4qgh-g8mx
title: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
summary: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
severity: high
cvss: 7.5
cwe:
  - CWE-407
  - CWE-436
vendor: elysia
product: elysia
ecosystem: npm
affected:
  - elysia < 1.4.29
patched:
  - elysia 1.4.29
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T21:54:51Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9643-4qgh-g8mx'
references:
  - url: 'https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56669'
  - url: >-
      https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329
  - url: 'https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9'
  - url: 'https://github.com/elysiajs/elysia/releases/tag/1.4.29'
  - url: 'https://github.com/advisories/GHSA-9643-4qgh-g8mx'
tags:
  - ghsa
  - npm
epss: 0.0063
epssPercentile: 0.47973
ingestedAt: '2026-09-23T22:33:56.541Z'
---

## Overview

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code.

Elysia uses `getAll` to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop has to do grows quadratically, so doubling the number of unique key-value pairs quadruples the amount of work. In the above PoC, each .getAll call scans through all of the `n` key-value pairs in the form data. Because there are `n` unique keys in the form data, there are .getAll calls, so in total the form data normalizer has to scan `n` x `n` key-value pairs.

### Impact
Endpoints using `multipart/form-data`

### Patches
1.4.29

### Workarounds
no 100% confirm workaround beside updating the patch

## Affected packages

- `elysia < 1.4.29`

## Remediation

Upgrade to a patched release:

- `elysia 1.4.29`