Elysia, a Typescript framework, suffers from an inefficient algorithm in its multipart/form-data handling. The getAll operation scales quadratically with the number of unique key-value pairs, so an attacker can send a payload containing many distinct become unresponsive. This flaw represents weaknesses classified under CWE-407 and CWE-436.

The vulnerability exists in all Elysia releases prior to 1.4.29, affecting deployments of elysiajs:elysia that rely on request validation or OpenAPI features. The issue was resolved in release 1.4.29, which replaces the quadratic getAll implementation with a linear-time approach.

With a CVSS score of 7.5, the flaw poses a moderate-to-high risk. The EPSS score is < 1% and the vulnerability is not listed in KEV. The only requirement for exploitation is the ability to submit multipart/form-data requests with a large number of a potential vector, and successful exploitation could lead to a denial of service for legitimate users.