Elysia, a TypeScript framework for request validation and OpenAPI documentation, has a bug that allows cookie values to be interpreted as prototype keys in versions before 1.4.27. Sending a cookie containing a key such as "__proto__" causes the framework to perform prototype pollution, which can overwrite properties on JavaScript’s base Object prototype. If an application later uses those polluted properties, it may lead to arbitrary code execution, privilege escalation, or other unintended behavior. The weakness is classified as CWE‑1321.

All installations of the Elysia JavaScript framework running version 1.4.26 or earlier are affected. This includes any Node.js application that uses Elysia for cookie parsing or request validation without additional filtering of cookie data.

Based on the description, it is inferred that an attacker can craft an HTTP request with a cookie value that includes "__proto__" to trigger the vulnerability. No authentication appears to be required for the request itself, though the ultimate impact depends on how the polluted prototype is used by the application. The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Prototype pollution can enable arbitrary code execution or unauthorized privilege escalation if the polluted properties are later leveraged in application logic.