Is CVE-2025-50864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-50864 being exploited in the wild.

How severe is CVE-2025-50864?

Medium severity, with a CVSS score of 6.5, published 20 August 2025.

Which products and versions are affected?

ElysiaJS Elysia-Cors thru 1.3.0; @elysiajs/cors (npm) SEMVER:introduced=0,fixed=1.3.1.

Is there a fix for CVE-2025-50864?

Yes. @elysiajs/cors (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-50864 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-50864?

Check whether you run ElysiaJS Elysia-Cors or @elysiajs/cors (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-50864: elysiajs elysia-cors CORS bypass via origin validation error

CVE-2025-50864 · Severity: medium · CVSS 6.5 · Published 2025-08-20

A vulnerability in the elysia-cors library, which manages security permissions for web applications, allows attackers to bypass domain restrictions. By using a domain name that contains a trusted domain as a substring (e.g., 'trusted.com.attacker.com'), an attacker can trick the system into granting unauthorized access. This could lead to unauthorized interactions with user data on websites using this library.

Vendors: ElysiaJS, npm.

Quick answers

Is CVE-2025-50864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-50864 being exploited in the wild.
How severe is CVE-2025-50864?: Medium severity, with a CVSS score of 6.5, published 20 August 2025.
Which products and versions are affected?: ElysiaJS Elysia-Cors thru 1.3.0; @elysiajs/cors (npm) SEMVER:introduced=0,fixed=1.3.1.
Is there a fix for CVE-2025-50864?: Yes. @elysiajs/cors (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-50864 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-50864?: Check whether you run ElysiaJS Elysia-Cors or @elysiajs/cors (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@elysiajs/cors (npm): upgrade to 1.3.1 or later
```
npm install @elysiajs/cors@1.3.1
```

Technical details

The elysia-cors library (versions up to 1.3.0) incorrectly validates the 'Origin' header by performing a substring match instead of an exact match against the configured whitelist. An attacker can bypass CORS policies by hosting a malicious site on a domain that contains the legitimate domain as a substring (e.g., 'victim.com.malicious.com' bypassing a 'victim.com' policy). This vulnerability is classified as CWE-178 (Improper Handling of Case Sensitivity/Origin Validation Error). A fix was introduced in version 1.3.1 which implements strict origin checking.

Affected products

elysiajs elysia-cors thru 1.3.0

Identifiers

CVE-2025-50864
GHSA-f9qj-4c5x-cpcw

Timeline

2025-05-08: patched: Fixed in version 1.3.1 via commit 9b9eb92e32a7a4b43b6d5108668941701c33e221
2025-08-20: disclosed
2025-08-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.