CVE-2026-31865: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31865 is a prototype pollution vulnerability in the Elysia TypeScript web framework affecting its cookie handling mechanism, allowing unauthenticated attackers to override cookie values via the __proto__ parameter. It affects all versions of the elysia npm package prior to 1.4.27. The vulnerability was published on March 16, 2026, by maintainer SaltyAom, and added to the GitHub Advisory Database on March 17, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Advisory, with an alternative score of 5.3 (Medium) per NVD (Github Advisory, Elysia Security Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), where Elysia's cookie parsing logic used standard JavaScript object literals ({}) for the cookie jar and related structures, making them susceptible to prototype chain manipulation (Github Advisory). An attacker can send an HTTP request with a cookie named __proto__ containing a URL-encoded JSON payload (e.g., __proto__=%7B%22injected%22%3A%22polluted%22%7D), which pollutes the prototype of the cookie object and can inject arbitrary properties visible to all objects inheriting from Object.prototype (Elysia Security Advisory). The fix in version 1.4.27 replaces object literals with Object.create(null) to create prototype-less objects, and explicitly skips cookie names matching __proto__, constructor, and prototype during parsing (Elysia Commit). A public proof-of-concept repository (ebadfd/elysia-cookie-proto-pollution) is referenced in the advisory.

Successful exploitation allows an unauthenticated remote attacker to tamper with application cookie values and inject arbitrary properties into the JavaScript object prototype chain, affecting both confidentiality and integrity. This can lead to unauthorized access to sensitive cookie data, manipulation of authentication or session cookies, and potential bypass of security controls or privilege escalation within the application (Github Advisory). Availability is not directly impacted, but the integrity risk is significant in applications that rely on cookie-based authentication or session management built on Elysia.

No evidence of active in-the-wild exploitation has been reported, and no weaponized exploit kit is known to include this vulnerability (Github Advisory). A public proof-of-concept repository (ebadfd/elysia-cookie-proto-pollution) is referenced in the official advisory, indicating that exploit code is publicly accessible. The EPSS score is approximately 0.022% (6th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify web applications built with the Elysia framework (npm package elysia < 1.4.27) by inspecting HTTP response headers, JavaScript bundle metadata, or open-source intelligence.
2. Craft malicious cookie: Construct an HTTP request with a cookie header containing the __proto__ key and a URL-encoded JSON payload, e.g., Cookie: a=legitimate; __proto__=%7B%22injected%22%3A%22polluted%22%7D.
3. Send the request: Deliver the crafted request to any endpoint of the vulnerable Elysia application that reads or processes cookies.
4. Trigger prototype pollution: Elysia's parseCookie function processes the __proto__ cookie name without filtering, assigning the attacker-controlled value to the object prototype, injecting properties (e.g., injected: 'polluted') into all objects inheriting from Object.prototype within the request context.
5. Achieve objective: Depending on application logic, the polluted prototype properties may override cookie-based authentication checks, session values, or other security-sensitive object properties, potentially enabling unauthorized access or privilege escalation (Elysia Security Advisory, Elysia Commit).

• Network: HTTP requests containing cookie headers with names __proto__, constructor, or prototype (e.g., Cookie: __proto__=%7B...%7D); URL-encoded JSON payloads in cookie values targeting Elysia endpoints.
• Logs: Web server or application access logs showing requests with cookie headers containing __proto__ or other prototype-related keys; repeated requests to cookie-consuming endpoints from the same source IP with unusual cookie names.
• Application Behavior: Unexpected properties appearing on JavaScript objects at runtime (e.g., phantom properties like injected on cookie or session objects); authentication or authorization bypasses not explained by normal application logic.

Upgrade the elysia npm package to version 1.4.27 or later, which patches the vulnerability by using Object.create(null) for cookie jar objects and explicitly filtering out __proto__, constructor, and prototype cookie names during parsing (Elysia Commit). For environments where immediate patching is not feasible, apply t.Cookie validation to enforce strict validation of cookie values and prevent unexpected cookie names from being processed. Additionally, restrict or disable cookie iteration in application code where possible to limit exposure (Elysia Security Advisory).

The vulnerability was reported by security researcher ebadfd, who also published a proof-of-concept repository (ebadfd/elysia-cookie-proto-pollution) referenced in the official advisory. The Elysia maintainer (SaltyAom) responded promptly with a patch released in version 1.4.27 on March 16, 2026, the same day the advisory was published (Elysia Security Advisory). No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation.