CVE-2025-66456

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.

• CWE-1321

• https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51ePatch
• https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849ePatch
• https://github.com/elysiajs/elysia/pull/1564Issue Tracking, Patch
• https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jfNot Applicable
• https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2ccExploit, Patch, Vendor Advisory
• https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jfNot Applicable
• https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2ccExploit, Patch, Vendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66450LibreChat is a ChatGPT clone with additional features. In ve…5.4
• CVE-2025-66451LibreChat is a ChatGPT clone with additional features. In ve…6.5
• CVE-2025-66452LibreChat is a ChatGPT clone with additional features. In ve…6.1
• CVE-2025-66453Rhino is an open-source implementation of JavaScript written…7.5
• CVE-2025-66454Arcade MCP allows you to to create, deploy, and share MCP Se…6.5
• CVE-2025-66455LMDeploy is a toolkit for compressing, deploying, and servin…9.8
• CVE-2025-66457Elysia is a Typescript framework for request validation, typ…8.8
• CVE-2025-66458Lookyloo is a web interface that allows users to capture a w…6.1
• CVE-2025-66459Lookyloo is a web interface that allows users to capture a w…6.1
• CVE-2025-6646PDF-XChange Editor U3D File Parsing Use-After-Free Informati…3.3
• CVE-2025-66460Lookyloo is a web interface that allows users to capture a w…6.1
• CVE-2025-66461FULLBACK Manager Pro provided by GS Yuasa International Ltd.…8.4