CVE-2025-66456: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66456 is a prototype pollution vulnerability in the Elysia TypeScript web framework (npm package elysia) affecting versions 1.4.0 through 1.4.16. The flaw exists in the mergeDeep function, which fails to sanitize the __proto__ key when merging results of two standalone schema validations with the same key. When combined with a related advisory (GHSA-8vch-m3f4-q8jf / CVE-2025-66457), it enables a full Remote Code Execution (RCE) chain. It was disclosed on December 9, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). In Elysia's mergeDeep utility (src/utils.ts), when two standalone schema validations share the same key and one uses an any type as a guard, the merge ordering allows the __proto__ property from attacker-controlled request body input to be merged into the object prototype. The fix in version 1.4.17 explicitly skips __proto__, constructor, and prototype keys during deep merging. The companion vulnerability GHSA-8vch-m3f4-q8jf (CVE-2025-66457) involves unsanitized cookie config values being injected into compiled route code, and when chained with CVE-2025-66456, allows an attacker to escalate prototype pollution into arbitrary code execution. A public proof-of-concept exists at https://github.com/sportshead/elysia-poc (GitHub Advisory, Patch Commit).

Successful exploitation of CVE-2025-66456 alone results in high confidentiality and integrity impact by allowing an attacker to manipulate JavaScript object prototypes, potentially altering application behavior, bypassing access controls, or corrupting data. When chained with GHSA-8vch-m3f4-q8jf, the combined attack enables full Remote Code Execution (RCE) on the server hosting the Elysia application, giving an unauthenticated remote attacker complete control over the affected system, including the ability to exfiltrate sensitive data, establish persistence, or pivot to other internal systems (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) repository (https://github.com/sportshead/elysia-poc) is referenced in the official security advisory, demonstrating the RCE chain. However, as of the advisory date, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.049% (0.000490), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to have routes with more than two standalone schema validations and an any type guard, which limits the attack surface somewhat (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using Elysia npm package versions 1.4.0–1.4.16 with routes that define more than two standalone schema validations (e.g., using z.object() with Zod) and at least one z.any() type as a standalone guard.
2. Craft malicious payload: Construct a JSON request body containing a __proto__ key with attacker-controlled properties, e.g.:

{
  "data": {
    "messageId": "pollute-me",
    "__proto__": {
      "foo": "bar"
    }
  }
}

3. Send the request: Submit an HTTP POST request with Content-Type: application/json to the vulnerable route endpoint, triggering the mergeDeep function to merge the __proto__ key into the object prototype.
4. Achieve prototype pollution: The __proto__ property is merged into Object.prototype, affecting all objects in the Node.js/Bun process and potentially altering application logic or security checks.
5. Chain with GHSA-8vch-m3f4-q8jf for RCE: If the application also has a controllable cookie config (e.g., via environment variables), leverage the polluted prototype to inject malicious values into the cookie config, which is then compiled unsanitized into route code, achieving arbitrary code execution on the server (GitHub Advisory, PoC Commit).

• Network: Unexpected HTTP POST requests to application endpoints with JSON bodies containing __proto__, constructor, or prototype keys; unusual outbound connections from the application server process.
• Logs: Application logs showing JSON parse errors or unexpected property merges; access logs with POST requests containing encoded __proto__ payloads in the body.
• File System: Unexpected new files, scripts, or cron jobs created by the application's runtime process (Node.js/Bun); web shells or reverse shell scripts in the application directory.
• Process: Unusual child processes spawned by the Bun or Node.js runtime (e.g., sh, bash, curl, wget); unexpected network listeners opened by the application process.
• Application Behavior: Unexpected changes in object property behavior across the application (e.g., {}.foo returning an attacker-controlled value); application errors related to prototype chain corruption (GitHub Advisory).

Upgrade Elysia to version 1.4.17 or later, which patches the mergeDeep function to explicitly skip __proto__, constructor, and prototype keys. For the companion RCE vulnerability (GHSA-8vch-m3f4-q8jf), upgrade to 1.4.18. As an immediate workaround if upgrading is not possible, add an onTransform hook to strip __proto__ from incoming JSON bodies:

new Elysia().onTransform(({ body, headers }) => {
  if (headers['content-type'] === 'application/json')
    return JSON.parse(JSON.stringify(body), (k, v) => {
      if (k === '__proto__') return
      return v
    })
})

Additionally, sanitize any cookie-related environment input using the overrideUnsafeQuote helper pattern introduced in the patch (GitHub Advisory, Patch PR).

The vulnerability was discovered and reported by security researcher sportshead, who also published a proof-of-concept repository. The Elysia maintainer (SaltyAom) responded promptly, releasing the patch on December 2, 2025 (merged PR #1564) and publishing the security advisory on December 9, 2025. The CVE appeared in Reddit's CVEWatch community as a top trending CVE for both December 10 and 11, 2025, and was noted by Checkmarx Zero on Bluesky, indicating moderate community attention. Red Hat also tracked the vulnerability in their security advisory database (GitHub Advisory, Red Hat).