6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31865

CVE-2026-31865: Elysia Cookie Value Prototype Pollution

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. __proto__. This issue is patched in 1.4.27. As a workaround, use t.Cookie validation to enforce validation value and/or prevent iterable over cookie if possible.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31865

CVE-2026-31865:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
elysia	npm	< 1.4.27	1.4.27

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the cookie parsing mechanism of Elysia, where a specially crafted cookie could lead to prototype pollution. The core of the issue is in the parseCookie function in src/cookies.ts. This function would iterate over cookies from the request headers and place them into a JavaScript object. If a cookie with the name __proto__ was sent, the code would inadvertently modify the Object.prototype instead of creating a property on the intended cookie jar object. The patch addresses this by adding a blocklist to the parseCookie function to ignore keys like __proto__, constructor, and prototype. Additionally, the patch proactively changes the initialization of several objects from {} to Object.create(null) in parseCookie, createCookieJar, and the Cookie constructor. This creates objects without a prototype, effectively preventing them from being polluted.

Vulnerable functions

parseCookie

src/cookies.ts

The `parseCookie` function is vulnerable to prototype pollution. Before the patch, it iterated through cookie entries and assigned them to the `jar` object without validating the cookie name. An attacker could provide a cookie with the name `__proto__`, which would lead to the modification of the `Object.prototype`. The patch mitigates this by explicitly checking for and skipping cookie names like `__proto__`, `constructor`, or `prototype`.

createCookieJar

src/cookies.ts

The `createCookieJar` function was also involved in the vulnerability. It initialized `set.cookie` as a plain object (`{}`), making it susceptible to prototype pollution. The patch changes this to `Object.create(null)`, which creates an object with no prototype, thus preventing pollution.

Cookie.constructor

src/cookies.ts

The constructor for the `Cookie` class initialized the `initial` property with a plain object (`{}`), which could be polluted. The patch changes this to `Object.create(null)` to prevent prototype pollution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.