Description
Prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the __proto__ prop to be merged.
Recommendation
Update the elysia package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.4.0, < 1.4.17
- Patched version(s): 1.4.17
References
Could your website be exposed too?
SmartScanner can check your website for Elysia vulnerable to prototype pollution with multiple standalone schema validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- json-schema-editor-visual vulnerable to prototype pollution - CVE-2025-57320
- algoliasearch-helper is vulnerable to Prototype Pollution in _merge() - CVE-2025-3193
- parse is vulnerable to prototype pollution - CVE-2025-57324
- node-cube vulnerable to prototype pollution - CVE-2025-57348
You might also like:
See something that needs correcting? Let us knowUpdated December 09, 2025