CVE-2025-66456Critical· 9.8▾ MidnightElysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging result…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the __proto__ prop to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the __proto__ key from body.
elysia >= 1.4.0, < 1.4.17Upgrade past the affected range:
elysia 1.4.17Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66457High· 8.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication
CVE-2026-56669High· 7.5elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
CVE-2026-118777Medium· 4.8Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
CVE-2026-118678High· 7.1n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
CVE-2026-118649High· 8.3n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`