# CVE-2025-50864: elysiajs elysia-cors CORS bypass via origin validation error

Source: https://junglewise.ai/threats/cve-2025-50864-elysiajs-elysia-cors-cors-bypass-via-origin-validation-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-20. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-50864 · Severity: medium · CVSS 6.5 · Published 2025-08-20

A vulnerability in the elysia-cors library, which manages security permissions for web applications, allows attackers to bypass domain restrictions. By using a domain name that contains a trusted domain as a substring (e.g., 'trusted.com.attacker.com'), an attacker can trick the system into granting unauthorized access. This could lead to unauthorized interactions with user data on websites using this library.

Vendors: [ElysiaJS](https://junglewise.ai/threats/vendors/elysiajs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-50864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-50864 being exploited in the wild.

**How severe is CVE-2025-50864?** Medium severity, with a CVSS score of 6.5, published 20 August 2025.

**Which products and versions are affected?** ElysiaJS Elysia-Cors thru 1.3.0; @elysiajs/cors (npm) SEMVER:introduced=0,fixed=1.3.1.

**Is there a fix for CVE-2025-50864?** Yes. @elysiajs/cors (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-50864 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-50864?** Check whether you run ElysiaJS Elysia-Cors or @elysiajs/cors (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @elysiajs/cors (npm): upgrade to 1.3.1 or later

  ```sh
  npm install @elysiajs/cors@1.3.1
  ```


## Technical details

The elysia-cors library (versions up to 1.3.0) incorrectly validates the 'Origin' header by performing a substring match instead of an exact match against the configured whitelist. An attacker can bypass CORS policies by hosting a malicious site on a domain that contains the legitimate domain as a substring (e.g., 'victim.com.malicious.com' bypassing a 'victim.com' policy). This vulnerability is classified as CWE-178 (Improper Handling of Case Sensitivity/Origin Validation Error). A fix was introduced in version 1.3.1 which implements strict origin checking.

## Affected products

- elysiajs elysia-cors thru 1.3.0

## Identifiers

- CVE-2025-50864
- GHSA-f9qj-4c5x-cpcw

## Timeline

- 2025-05-08: patched: Fixed in version 1.3.1 via commit 9b9eb92e32a7a4b43b6d5108668941701c33e221
- 2025-08-20: disclosed
- 2025-08-20: advisory

## References

- [https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts](https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts)
- [https://github.com/elysiajs/elysia-cors/commit/9b9eb92e32a7a4b43b6d5108668941701c33e221](https://github.com/elysiajs/elysia-cors/commit/9b9eb92e32a7a4b43b6d5108668941701c33e221)
- [https://github.com/elysiajs/elysia-cors/tree/main](https://github.com/elysiajs/elysia-cors/tree/main)
- [https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a](https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a)