# CVE-2026-56669: Elysia denial of service via quadratic complexity in form data normalization

Source: https://junglewise.ai/threats/cve-2026-56669-elysia-denial-of-service-via-quadratic-complexity-in-form-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-56669 · Severity: high · CVSS 7.5 · Published 2026-07-08

Elysia is a web framework used to build fast servers and APIs with TypeScript. A flaw in how the framework handles web forms allows an attacker to send a specially crafted request that forces the server to perform excessive calculations. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive, disrupting business operations and service availability.

Technologies: [ElysiaJS Elysia](https://junglewise.ai/threats/technologies/elysia), [elysia (npm)](https://junglewise.ai/threats/technologies/npm-elysia). Vendors: [ElysiaJS](https://junglewise.ai/threats/vendors/elysiajs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-56669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56669 being exploited in the wild.

**How severe is CVE-2026-56669?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** ElysiaJS Elysia < 1.4.29; elysia (npm) SEMVER:introduced=0,fixed=1.4.29.

**Is there a fix for CVE-2026-56669?** Yes. elysia (npm): upgrade to 1.4.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56669 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56669?** Check whether you run ElysiaJS Elysia or elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- elysia (npm): upgrade to 1.4.29 or later

  ```sh
  npm install elysia@1.4.29
  ```


## Technical details

Elysia (prior to v1.4.29) is vulnerable to a Denial of Service (DoS) via CPU exhaustion due to inefficient algorithmic complexity (CWE-407) in its form data normalization logic. The framework utilized the `.getAll()` method within a loop when processing `multipart/form-data` or URL-encoded endpoints. Because many JavaScript runtimes implement `FormData` methods using linear scans, the normalization process resulted in quadratic time complexity relative to the number of unique key-value pairs. An unauthenticated remote attacker can exploit this by sending a request with a large number of unique keys (e.g., 500,000), causing the server to hang while processing the payload. The issue is resolved in version 1.4.29 by refactoring the normalization to avoid repeated linear scans.

## Affected products

- elysiajs Elysia < 1.4.29

## Identifiers

- CVE-2026-56669
- GHSA-9643-4qgh-g8mx

## Timeline

- 2026-06-16: patched: Version 1.4.29 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE-2026-56669 published to NVD

## References

- [https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9](https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9)
- [https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329](https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329)
- [https://github.com/elysiajs/elysia/releases/tag/1.4.29](https://github.com/elysiajs/elysia/releases/tag/1.4.29)
- [https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx](https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx)

## Related threats

- [Elysia cookie value prototype pollution](https://junglewise.ai/threats/cve-2026-31865-elysia-cookie-value-prototype-pollution)
- [Elysia string URL format ReDoS](https://junglewise.ai/threats/cve-2026-30837-elysia-string-url-format-redos)
- [Elysia arbitrary code injection through cookie config](https://junglewise.ai/threats/cve-2025-66457-elysia-arbitrary-code-injection-through-cookie-config)
- [Elysia prototype pollution in schema validation](https://junglewise.ai/threats/cve-2025-66456-elysia-prototype-pollution-in-schema-validation)