CVE-2026-56669 (CVSS 7.5)

Description

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.

Is your site exposed to CVE-2026-56669?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0036

Probability of exploitation

0.28%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-407 CWE-407

CWE-436 CWE-436

References

Other References

https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9 https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329 https://github.com/elysiajs/elysia/releases/tag/1.4.29 https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx

Frequently Asked Questions

What is CVE-2026-56669? +

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-56669? +

CVE-2026-56669 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0036, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-56669? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-82760

Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 …

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes …

CVE-2026-83613

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions …

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated …

CVE-2026-45822

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and …

CVE-2026-83614