Description
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site’s CORS policy, rather than performing an exact match.
Recommendation
Update the @elysiajs/cors package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.3.1
- Patched version(s): 1.3.1
References
Could your website be exposed too?
SmartScanner can check your website for elysia-cors Origin Validation Error and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox - CVE-2025-59845
- @farmfe/core is Missing Origin Validation in WebSocket - CVE-2025-56647
- Elysia vulnerable to prototype pollution with multiple standalone schema validation - CVE-2025-66456
- Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - CVE-2025-59845
You might also like:
See something that needs correcting? Let us knowUpdated January 29, 2026