npmPackage

elysia

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 1.4.31 (Nov 5, 2026): no advisory affects it
Newest unaffected release: 1.4.31 (Nov 5, 2026), the latest release
Advisories: 5 · 1 critical, 3 high, 1 medium

Weekly downloads: 1.9M
Dependents: 532
Releases: 500+ since 1.0.0 (Mar 16, 2024)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-56669
Affects 1.0.0-beta.4 to 1.4.28 (1.4.29 is outside it)
CVE-2026-31865
Affects 1.0.0-beta.4 to 1.4.26 (1.4.27 is outside it)
CVE-2026-30837
Affects 1.0.0-beta.4 to 1.4.25 (1.4.26 is outside it)
CVE-2025-66457
Affects 1.0.0-beta.4 to 1.4.17 (1.4.18 is outside it)
CVE-2025-66456
Affects 1.4.0 to 1.4.17-exp.1 (1.4.17 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 5

CVE-2026-56669High 7.5
Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
Affected: fixed in 1.4.29.
Fixed in 1.4.29 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.4.31, is not affected.
19% of elysia downloads last week were affected versions (388.2K).
CVE-2026-31865Medium 6.5
Elysia Cookie Value Prototype Pollution
Affected: fixed in 1.4.27.
Fixed in 1.4.27 (released Mar 1, 2026, 17 days before disclosure).
The latest release, 1.4.31, is not affected.
11% of elysia downloads last week were affected versions (233.3K).
CVE-2026-30837High 7.5
Elysia has a string URL format redos
Affected: fixed in 1.4.26.
Fixed in 1.4.26 (released Feb 25, 2026, 13 days before disclosure).
The latest release, 1.4.31, is not affected.
11% of elysia downloads last week were affected versions (221.2K).
CVE-2025-66457High 7.5
Elysia affected by arbitrary code injection through cookie config
Affected: fixed in 1.4.18.
Fixed in 1.4.18 (released Dec 4, 2025, 5 days before disclosure).
The latest release, 1.4.31, is not affected.
7.2% of elysia downloads last week were affected versions (147.4K).
CVE-2025-66456Critical 9.1
Elysia vulnerable to prototype pollution with multiple standalone schema validation
Affected: from 1.4.0, fixed in 1.4.17.
Fixed in 1.4.17 (released Dec 2, 2025, 7 days before disclosure).
The latest release, 1.4.31, is not affected.
3.5% of elysia downloads last week were affected versions (72.6K).