CVE-2026-56669: Elysia Framework DoS Vulnerability

CVE-2026-56669 Overview

CVE-2026-56669 is a denial-of-service vulnerability in Elysia, a TypeScript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. Versions prior to 1.4.29 normalize multipart/form-data payloads using FormData.getAll() inside a loop over unique keys. This produces quadratic time complexity relative to the number of unique key-value pairs. An unauthenticated attacker can submit crafted multipart requests to exhaust server CPU. The issue is classified under CWE-407: Inefficient Algorithmic Complexity and is fixed in Elysia 1.4.29.

Critical Impact
A remote, unauthenticated attacker can trigger sustained CPU exhaustion on any Elysia endpoint that accepts multipart form data, degrading or halting service availability.

Affected Products

Elysia TypeScript framework versions prior to 1.4.29
Applications exposing multipart/form-data endpoints via Elysia
Node.js and Bun-based services built on vulnerable Elysia releases

Discovery Timeline

2026-07-08 - CVE-2026-56669 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-56669

Vulnerability Analysis

Elysia's form-data normalization iterated over unique keys returned by form.keys() and, for each key, called form.getAll(key) to gather the associated values. Because FormData.keys() yields duplicates and getAll performs a full scan of the internal entry list for every invocation, the combined operation scales as O(n²) with the number of form entries. A single request containing thousands of repeated field names forces the runtime to perform hundreds of millions of comparisons, saturating a single event-loop thread.

The vulnerability affects both the standard web adapter (src/adapter/web-standard/index.ts) and the dynamic handler (src/dynamic-handle.ts), so any Elysia route that parses multipart form data is exposed.

Root Cause

The root cause is inefficient algorithmic complexity ([CWE-407]) in the form parsing routine. Repeated calls to form.getAll() inside a for loop over form.keys() create a quadratic hot path that is trivial to trigger with malformed but valid multipart input.

Attack Vector

Exploitation requires no authentication, no user interaction, and only a network path to a vulnerable endpoint. An attacker sends a multipart/form-data request with a large number of duplicate field names. The server consumes CPU processing the payload, blocking other requests on the same worker.

typescript

// Security patch in src/dynamic-handle.ts - group entries in a single pass
body = {}

const form = await request.formData()
const grouped = new Map<string, any[]>()
form.forEach((v, k) => {
    const list = grouped.get(k)
    if (list) list.push(v)
    else grouped.set(k, [v])
})
for (const [key, value] of grouped) {
    if (body[key]) continue

    const finalValue = normalizeFormValue(value)

    if (key.includes('.') || key.includes('['))

Source: GitHub commit 8358ff9

The fix replaces the nested getAll calls with a single linear forEach pass that groups values by key into a Map, reducing the complexity to O(n).

Detection Methods for CVE-2026-56669

Indicators of Compromise

Sustained 100% CPU utilization on Node.js or Bun worker processes serving Elysia routes
Inbound multipart/form-data requests with abnormally large Content-Length and thousands of repeated field names
Event-loop lag spikes and increased p95/p99 latency on unrelated routes hosted by the same process
Sudden drop in requests-per-second throughput without corresponding infrastructure changes

Detection Strategies

Instrument HTTP middleware to log multipart requests exceeding a configurable field-count threshold
Correlate CPU saturation events with concurrent multipart request volume from single source IPs
Compare Elysia dependency versions in package.json and lockfiles against the patched 1.4.29 release
Review web application firewall (WAF) telemetry for repeated POST requests with identical form field names

Monitoring Recommendations

Enable per-request CPU time metrics and alert when a single request exceeds an expected upper bound
Track event-loop lag using Node.js perf_hooks or Bun equivalents and alert on sustained regressions
Log source IPs that produce disproportionate multipart payload sizes for downstream rate limiting

How to Mitigate CVE-2026-56669

Immediate Actions Required

Upgrade Elysia to version 1.4.29 or later across all services and container images
Audit reverse proxies and API gateways to enforce request body size and multipart field count limits
Rate-limit unauthenticated multipart endpoints at the edge until patched builds are deployed
Restart affected services after upgrade to ensure the patched code path is loaded

Patch Information

The fix is included in the Elysia 1.4.29 release. Technical details and disclosure notes are available in the GHSA-9643-4qgh-g8mx security advisory and the reproduction gist.

Workarounds

Reject multipart requests with excessive field counts at the reverse proxy or WAF layer
Constrain Content-Length on multipart endpoints to values consistent with legitimate client behavior
Move multipart parsing behind authenticated routes where feasible to reduce unauthenticated exposure

bash

# Upgrade Elysia to the patched release
bun add elysia@1.4.29
# or
npm install elysia@1.4.29

# Verify installed version
npm ls elysia