Is CVE-2025-66457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66457 being exploited in the wild.

How severe is CVE-2025-66457?

High severity, with a CVSS score of 8.8, published 9 December 2025.

Which products and versions are affected?

elysia (npm) SEMVER:introduced=0,fixed=1.4.18.

Is there a fix for CVE-2025-66457?

Yes. elysia (npm): upgrade to 1.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66457 attacked?

It is attacked over the network.

Am I affected by CVE-2025-66457?

Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66457: Elysia arbitrary code injection through cookie config

CVE-2025-66457 · Severity: high · CVSS 8.8 · Published 2025-12-09

Elysia is a web framework for building backend applications. When cookie validation is enabled with dynamic schemas, unsanitized cookie configuration (often sourced from environment variables) is directly injected into compiled route code, allowing attackers who control the configuration to execute arbitrary code on the server. This vulnerability becomes a complete remote code execution vector when combined with a prototype pollution flaw in the same framework.

Technologies: ElysiaJS Elysia, elysia (npm). Vendors: ElysiaJS, npm.

Quick answers

Is CVE-2025-66457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66457 being exploited in the wild.
How severe is CVE-2025-66457?: High severity, with a CVSS score of 8.8, published 9 December 2025.
Which products and versions are affected?: elysia (npm) SEMVER:introduced=0,fixed=1.4.18.
Is there a fix for CVE-2025-66457?: Yes. elysia (npm): upgrade to 1.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66457 attacked?: It is attacked over the network.
Am I affected by CVE-2025-66457?: Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

elysia (npm): upgrade to 1.4.18 or later
```
npm install elysia@1.4.18
```

Technical details

This is a code injection vulnerability (CWE-94) in Elysia's ahead-of-time (AOT) compiler. When a cookie schema is defined on a route and cookies are dynamically enabled, the framework injects the cookie configuration directly into generated code without sanitizing string values. An attacker with write access to the cookie configuration (typically via environment variables) can inject malicious code that executes during route compilation. The attack requires high privileges (write access to app config/environment) and is only exploitable when AOT compilation is enabled (the default). Patches are available in version 1.4.18 and later; a workaround exists to sanitize configuration strings by escaping template literals and variable references.

Affected products

Elysia Elysia < 1.4.18

Identifiers

CVE-2025-66457
GHSA-8vch-m3f4-q8jf

Timeline

2025-12-09: disclosed
2025-12-09: patched: Fixed in version 1.4.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.