Executive brief
Elysia is a web framework used to build fast servers and APIs with TypeScript. A flaw in how the framework handles web forms allows an attacker to send a specially crafted request that forces the server to perform excessive calculations. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive, disrupting business operations and service availability.
Technical details
Elysia (prior to v1.4.29) is vulnerable to a Denial of Service (DoS) via CPU exhaustion due to inefficient algorithmic complexity (CWE-407) in its form data normalization logic. The framework utilized the `.getAll()` method within a loop when processing `multipart/form-data` or URL-encoded endpoints. Because many JavaScript runtimes implement `FormData` methods using linear scans, the normalization process resulted in quadratic time complexity relative to the number of unique key-value pairs. An unauthenticated remote attacker can exploit this by sending a request with a large number of unique keys (e.g., 500,000), causing the server to hang while processing the payload. The issue is resolved in version 1.4.29 by refactoring the normalization to avoid repeated linear scans.
Affected products
- elysiajs Elysia < 1.4.29
Timeline
- 2026-06-16: patched: Version 1.4.29 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE-2026-56669 published to NVD