What is the CVSS score of EUVD-2026-12749?

EUVD-2026-12749 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Prototype Pollution are affected by EUVD-2026-12749?

CVE-2026-31865 presents notable security risk, a prototype pollution vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-12749?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Prototype Pollution EUVD-2026-12749

| CVE-2026-31865 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-17 https://github.com/elysiajs/elysia

GHSA-8hq9-phh3-p2wp

Code Injection Prototype Pollution

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12749

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 16:17 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

bash

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

Use t.Cookie validation to enforce validation value
Prevent iterable over cookie if possible

AnalysisAI

Elysia (npm package, versions prior to 1.4.27) is vulnerable to prototype pollution through maliciously crafted cookie names, allowing unauthenticated attackers to override application cookie values and potentially inject arbitrary data into the application's object prototype. With a CVSS score of 6.5 and network-accessible attack vector requiring no privileges or user interaction, attackers can manipulate cookie handling to gain limited information disclosure and integrity compromise. A proof-of-concept exploit demonstrating the __proto__ injection vector exists in the GitHub advisory.

Technical ContextAI

Elysia is a popular Node.js web framework (CPE: pkg:npm/elysia) that handles HTTP cookie parsing and management. The vulnerability stems from CWE-1321 (Prototype Pollution), a class of code injection flaws where attacker-controlled input is merged into JavaScript objects without proper sanitization, allowing modification of the Object prototype itself. When Elysia processes incoming HTTP cookies, it fails to filter or validate special property names like __proto__, constructor, and prototype. An attacker sending a crafted cookie header with a name such as __proto__=%7B%22injected%22%3A%22polluted%22%7D (URL-encoded JSON) causes the cookie parsing logic to pollute the prototype chain, affecting all objects created subsequently in that application process. This is a server-side code injection vulnerability triggered through the HTTP Cookie header (CWE-1321 encompasses unsafe object merging patterns).

RemediationAI

Immediately upgrade Elysia to version 1.4.27 or later, which includes the patch committed at e9d6b1743fa7368ef942dce181f6a089757f6aab (visible in the GitHub advisory at https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp). For applications unable to patch immediately, implement the following workarounds: (1) Apply strict validation to all cookie values using Elysia's t.Cookie validation schema to reject cookies with suspicious or unexpected structures, (2) minimize iteration over cookie objects in application code to reduce the window for prototype pollution exploitation, and (3) consider disabling or restricting cookie handling at the reverse proxy or WAF layer if feasible. Test patches in staging environments before production deployment to ensure compatibility with existing cookie-dependent application logic.