elysia-cors Origin Validation Error

Description

An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site’s CORS policy, rather than performing an exact match.

Recommendation

Update the @elysiajs/cors package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.1
• Patched version(s): 1.3.1

References

• GHSA-f9qj-4c5x-cpcw
• medium.com
• elysiajs.com
• CVE-2025-50864
• CWE-178
• CWE-346
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox - CVE-2025-59845
• @farmfe/core is Missing Origin Validation in WebSocket - CVE-2025-56647
• Elysia vulnerable to prototype pollution with multiple standalone schema validation - CVE-2025-66456
• Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - CVE-2025-59845

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@elysiajs/cors