Is CVE-2026-56669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56669 being exploited in the wild.

How severe is CVE-2026-56669?

High severity, with a CVSS score of 7.5, published 8 July 2026.

Which products and versions are affected?

ElysiaJS Elysia < 1.4.29; elysia (npm) SEMVER:introduced=0,fixed=1.4.29.

Is there a fix for CVE-2026-56669?

Yes. elysia (npm): upgrade to 1.4.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56669 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56669?

Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56669: Elysia denial of service via quadratic complexity in form data normalization

Q: Which products and versions are affected?

ElysiaJS Elysia < 1.4.29; elysia (npm) SEMVER:introduced=0,fixed=1.4.29.

Q: Is there a fix for CVE-2026-56669?

Yes. elysia (npm): upgrade to 1.4.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56669 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56669?

Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56669 · Severity: high · CVSS 7.5 · Published 2026-07-08

Elysia is a web framework used to build fast servers and APIs with TypeScript. A flaw in how the framework handles web forms allows an attacker to send a specially crafted request that forces the server to perform excessive calculations. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive, disrupting business operations and service availability.

Technologies: ElysiaJS Elysia, elysia (npm). Vendors: ElysiaJS, npm.

Quick answers

Is CVE-2026-56669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56669 being exploited in the wild.
How severe is CVE-2026-56669?: High severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: ElysiaJS Elysia < 1.4.29; elysia (npm) SEMVER:introduced=0,fixed=1.4.29.
Is there a fix for CVE-2026-56669?: Yes. elysia (npm): upgrade to 1.4.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56669 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56669?: Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

elysia (npm): upgrade to 1.4.29 or later
```
npm install elysia@1.4.29
```

Technical details

Elysia (prior to v1.4.29) is vulnerable to a Denial of Service (DoS) via CPU exhaustion due to inefficient algorithmic complexity (CWE-407) in its form data normalization logic. The framework utilized the `.getAll()` method within a loop when processing `multipart/form-data` or URL-encoded endpoints. Because many JavaScript runtimes implement `FormData` methods using linear scans, the normalization process resulted in quadratic time complexity relative to the number of unique key-value pairs. An unauthenticated remote attacker can exploit this by sending a request with a large number of unique keys (e.g., 500,000), causing the server to hang while processing the payload. The issue is resolved in version 1.4.29 by refactoring the normalization to avoid repeated linear scans.

Affected products

elysiajs Elysia < 1.4.29

Identifiers

CVE-2026-56669
GHSA-9643-4qgh-g8mx

Timeline

2026-06-16: patched: Version 1.4.29 released
2026-07-02: advisory: GitHub Security Advisory published
2026-07-08: disclosed: CVE-2026-56669 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.