EUVD-2026-42394Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low-complexity, unauthenticated request to any multipart endpoint triggers CPU exhaustion; impact is availability-only with no confidentiality or integrity effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.
AnalysisAI
Denial of service in the Elysia TypeScript web framework (versions prior to 1.4.29) lets remote unauthenticated attackers exhaust server CPU by submitting multipart/form-data requests containing many unique key-value pairs. Elysia's form-data normalization uses getAll in a way that scales quadratically with the number of fields, so a single crafted request can consume disproportionate processing time and stall the event loop. A public technical write-up demonstrating the quadratic behavior exists, but there is no evidence of active exploitation; EPSS was not provided.
Technical ContextAI
Elysia is a Bun-oriented TypeScript framework providing request validation, type inference, and OpenAPI tooling. The flaw is an algorithmic-complexity issue (CWE-407, Inefficient Algorithmic Complexity) in how the framework normalizes multipart/form-data bodies: it repeatedly calls getAll() while iterating over form fields, turning what should be linear parsing into O(n²) work as the number of distinct keys grows. Because Bun/Node runtimes are single-threaded event loops, sustained CPU-bound work in the request path blocks all concurrent request handling, translating an algorithmic inefficiency into a service-wide availability failure. The fixing commit (8358ff9) changes the normalization approach and is shipped in release 1.4.29.
RemediationAI
Vendor-released patch: upgrade to Elysia 1.4.29, which replaces the quadratic getAll-based form-data normalization (fix commit https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329, released at https://github.com/elysiajs/elysia/releases/tag/1.4.29). This is the primary and recommended fix. If immediate upgrading is not possible, reduce exposure by placing a reverse proxy or WAF limit on multipart/form-data request body size and on the number of form fields accepted per request, which caps the quadratic blow-up at the cost of rejecting legitimately large multipart uploads; alternatively, temporarily disable or restrict access to endpoints that accept multipart/form-data if they are non-essential. Refer to the security advisory GHSA-9643-4qgh-g8mx for authoritative guidance.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today