CVE-2025-66456 is a prototype pollution flaw in the mergeDeep function of the Elysia TypeScript framework, affecting versions 1.4.0 through 1.4.16. Combined with a second advisory about cookie configuration, it allows full remote code execution. Upgrade to 1.4.18 to cover both. The record scores it 9.8.
What's affected
- Package: elysia on npm.
- Affected: 1.4.0 through 1.4.16 for this CVE. The advisory for it gives the range as 1.4.0 up to before 1.4.17, patched in 1.4.17.
- Condition: routes with more than one standalone schema validation, for example with a validation library such as zod, where the same key is merged.
- Related advisory: GHSA-8vch-m3f4-q8jf, arbitrary code injection through cookie config, which affects versions before 1.4.18. The two together make the full chain.
Versions and severity differ across sources. The record scores 9.8 (critical). The advisory uses CVSS 4.0 and rates it 9.1 (critical). The related cookie advisory is High 7.5, and its text says patched in 1.4.17 while its range says before 1.4.18. Moving straight to 1.4.18 or later avoids the question.
How to check if you're exposed
List the installed version in each project.
npm ls elysia
bun pm ls | grep elysia
If it is from 1.4.0 to 1.4.16, you are affected by this CVE, and anything below 1.4.18 is affected by the related cookie issue. Then check your code: do you use standalone guard schemas that validate the same key twice, and do you pass cookie settings, such as secrets, from a source that someone other than your developers could write, like environment variables?
What to do now
- Upgrade elysia to 1.4.18 or later and regenerate lock files.
- Review where cookie configuration comes from. The related advisory says it is only exploitable if an attacker can write to that config, such as through an environment you do not fully control.
- As a stopgap the advisory shows removing the
__proto__key from incoming request bodies before they are merged. - Rebuild and redeploy services, since compiled routes contain the old code.
- Check other TypeScript services for the same pins. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The class is CWE-1321, modification of object prototype attributes. When code merges objects deeply and accepts a special key such as __proto__, an attacker can change the base object that every other object inherits from. By itself that can alter application behavior. The advisory says that combined with the cookie configuration issue, where untrusted values are placed into compiled route code, the result is remote code execution.
This is a good example of why chains matter more than individual scores. The cookie flaw is rated High with a narrow trigger, and the pollution flaw supplies the way to reach it. The record does not mark exploitation in the wild, and the CVE is not on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch both advisories separately?
Upgrading to 1.4.18 or later covers both, based on the advisory ranges.
Does every Elysia app use the vulnerable path?
No. It needs multiple standalone schema validations that merge the same key, according to the advisory.
Sources
- Prototype pollution advisory GHSA-hxj9-33pp-j2cc
- Cookie config advisory GHSA-8vch-m3f4-q8jf
- Safeguard Gold entry
Last reviewed: 18 October 2026.
