{"vulnerability": "ghsa-9643-4qgh-g8mx", "sightings": [{"uuid": "7ccc9c3d-00f8-4199-83e3-60b99bd6715c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9643-4qgh-g8mx", "type": "seen", "source": "https://gist.github.com/alon710/57af1221d4a8dd965c728b35cf4f28c3", "content": "# CVE-2026-56669: CVE-2026-56669: Remote Denial of Service via Algorithmic Complexity and Interpretation Conflict in Elysia\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56669\n\n## Summary\nCVE-2026-56669 is a high-severity vulnerability in the Elysia web framework (ElysiaJS) that combines Inefficient Algorithmic Complexity (CWE-407) and an Interpretation Conflict (CWE-436). It allows remote, unauthenticated attackers to cause a complete Denial of Service (DoS) via CPU resource exhaustion using specially crafted multipart or urlencoded payloads.\n\n## TL;DR\nA high-severity denial-of-service vulnerability in Elysia prior to v1.4.29 allows remote, unauthenticated attackers to freeze the server's single-threaded event loop. By using an interpretation conflict to bypass request-size filters, attackers can submit thousands of unique keys that trigger quadratic processing times during form-data normalization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407, CWE-436\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0063 (Percentile: 48.83%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC) Public\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- ElysiaJS web applications running on Bun or Node.js runtimes using versions prior to 1.4.29\n- **elysia**: < 1.4.29 (Fixed in: `1.4.29`)\n\n## Mitigation\n\n- Upgrade to Elysia version 1.4.29 or later.\n- Filter and sanitize malformed HTTP Content-Type headers at the reverse proxy or WAF layer.\n- Enforce limit controls on the maximum number of allowed keys in incoming HTTP requests.\n\n**Remediation Steps:**\n1. Locate the package.json file of the Elysia project.\n2. Update the 'elysia' dependency to version '^1.4.29'.\n3. Run 'bun install' or 'npm install' to apply the update.\n4. Verify the deployment in a staging environment by testing standard form-data submissions.\n\n## References\n\n- [Elysia Security Advisory GHSA-9643-4qgh-g8mx](https://github.com/elysiajs/elysia/security/advisories/GHSA-9643-4qgh-g8mx)\n- [Official Fix Commit](https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329)\n- [Elysia Release v1.4.29](https://github.com/elysiajs/elysia/releases/tag/1.4.29)\n- [Original Exploit PoC Gist](https://gist.github.com/jviide/ea040eabe7bac058326174e2cd42dfd9)\n- [PoC Gist Raw Text](https://gist.githubusercontent.com/jviide/ea040eabe7bac058326174e2cd42dfd9/raw)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56669) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T22:31:39.409419Z"}]}