CVE-2025-66456
Elysiajs Elysia 1.4.0 – 1.4.17
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-66456 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Elysiajs Elysia. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-66456 is a prototype pollution vulnerability (CWE-1321) affecting the Elysia TypeScript framework, which handles request validation, type inference, OpenAPI documentation, and client-server communication. The issue resides in the `mergeDeep` function, occurring after merging results from two standard schema validations sharing the same key. This flaw impacts versions 1.4.0 through 1.4.16, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation hinges on specific conditions, including an "any" type set as a standalone guard that permits the `__proto__` property to merge during the validation process. When chained with GHSA-8vch-m3f4-q8jf, it enables full remote code execution (RCE) by polluting the JavaScript prototype chain.
The vulnerability is fixed in Elysia version 1.4.17. As a workaround, applications should remove the `__proto__` key from request bodies prior to processing. Official advisories and patches are detailed in GitHub security advisory GHSA-hxj9-33pp-j2cc, related advisory GHSA-8vch-m3f4-q8jf, pull request #1564, and commits 26935bf76ebc43b4a43d48b173fc853de43bb51e and 3af978663e437dccc6c1a2a3aff4b74e1574849e.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202180
Vulnerability Data
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to…
more
the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure development lifecycle mandates input validation and object-handling controls that directly prevent prototype pollution.
Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.