CVE-2025-66456: Elysiajs Elysia RCE Vulnerability

CVE-2025-66456 Overview

CVE-2025-66456 is a critical prototype pollution vulnerability discovered in Elysia, a TypeScript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. The vulnerability exists in the mergeDeep function, which improperly handles object merging after two standard schema validations with the same key, allowing attackers to inject malicious properties through the __proto__ property.

Critical Impact
When combined with GHSA-8vch-m3f4-q8jf, this prototype pollution vulnerability enables full Remote Code Execution (RCE) by an attacker, potentially compromising the entire server and any data it processes.

Affected Products

Elysiajs Elysia versions 1.4.0 through 1.4.16

Discovery Timeline

2025-12-09 - CVE-2025-66456 published to NVD
2025-12-17 - Last updated in NVD database

Technical Details for CVE-2025-66456

Vulnerability Analysis

The vulnerability resides in the mergeDeep function within Elysia's schema validation pipeline. During the merging of schema validation results that share the same key, the function fails to properly sanitize the __proto__ property from user-controlled input. This allows an attacker to pollute the Object prototype, potentially affecting all JavaScript objects in the application runtime.

For the vulnerability to be exploitable, there must be an any type set as a standalone guard configuration. This condition allows the __proto__ property to be merged into the object hierarchy during schema validation processing. When chained with the related vulnerability tracked as GHSA-8vch-m3f4-q8jf, attackers can achieve full remote code execution on vulnerable servers.

Root Cause

The root cause is the improper handling of object property merging in the mergeDeep function. The function does not filter or sanitize special JavaScript properties like __proto__, constructor, or prototype before performing deep merge operations. When schema validations are configured with any types in standalone guards, these dangerous properties from request bodies can propagate through the merge process and pollute the global Object prototype.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft a malicious HTTP POST request containing a specially constructed body with __proto__ properties. When the Elysia application processes this request through schema validation with the vulnerable guard configuration, the malicious properties are merged into the Object prototype, enabling subsequent exploitation such as arbitrary code execution.

typescript

// Example of vulnerable guard configuration (from security patch)
const app = new Elysia()
	.guard({
		schema: 'standalone',
		body: z.object({
			data: z.any()
		})
	})
	.post('/', ({ body }) => ({ body, win: {}.foo }), {
		body: z.object({
			data: z.object({
				messageId: z.string('pollute-me')
			})
		})
	})

Source: GitHub Commit

The security patch also introduced proper sanitization for cookie values to prevent injection attacks:

typescript

// Security fix: sanitize cookie key and values
const overrideUnsafeQuote = (value: string) =>
	'`' + value.replace(/`/g, '\\`').replace(/\${/g, '$\\{') + '`'

Source: GitHub Commit

Detection Methods for CVE-2025-66456

Indicators of Compromise

HTTP POST requests containing __proto__, constructor, or prototype keys in JSON request bodies
Unusual application behavior or errors related to Object property access
Unexpected modifications to global object prototypes in application logs
Signs of arbitrary code execution following suspicious request patterns

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block requests containing __proto__, constructor, or prototype in JSON payloads
Deploy runtime application self-protection (RASP) solutions to monitor for prototype pollution attempts
Review application logs for malformed JSON payloads targeting schema validation endpoints
Use Node.js security modules that detect prototype pollution at runtime

Monitoring Recommendations

Enable detailed request logging for all endpoints using schema validation with any types
Set up alerts for HTTP 500 errors that may indicate exploitation attempts
Monitor for anomalous process spawning or network connections from the Node.js application
Implement integrity monitoring for JavaScript object prototypes in production environments

How to Mitigate CVE-2025-66456

Immediate Actions Required

Upgrade Elysia to version 1.4.17 or later immediately
Audit all route configurations using standalone guards with any types
Remove __proto__ key from request bodies at the application entry point as a temporary measure
Review application code for potential exploitation of prototype pollution

Patch Information

The vulnerability has been fixed in Elysia version 1.4.17. The patch introduces proper sanitization of dangerous properties during object merging operations. Security fixes are available in the following commits:

Primary security fix - Addresses prototype pollution and cookie injection
Additional fix - Sanitizes cookie key handling

For full details, see the GitHub Security Advisory GHSA-hxj9-33pp-j2cc.

Workarounds

Implement middleware to strip __proto__, constructor, and prototype keys from all incoming request bodies before schema validation
Avoid using any types in standalone guard configurations until the patch is applied
Use Object.freeze(Object.prototype) in application initialization to prevent prototype modifications (may affect application functionality)
Deploy a reverse proxy or WAF that sanitizes JSON payloads before they reach the Elysia application

bash

# Update Elysia to patched version
npm update elysia@1.4.17

# Or install specific patched version
npm install elysia@1.4.17