CyberRota Analysis
AI-GeneratedElysia, a Typescript framework, is vulnerable to a denial-of-service attack due to inefficient handling of multipart/form-data endpoints, which can lead to CPU exhaustion as the number of unique key-value pairs increases. This issue affects versions prior to 1.4.29, and organizations using Elysia for request validation and client-server communication should prioritize upgrading to the patched version to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.