https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-31865.htmlhttps://patchthecve.com/cve/CVE-2026-31865.htmlWed, 17 Jun 2026 10:34:39 +0000MEDIUM 6.5: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. `__proto__`. This issue is patched in 1.4.27. As a workaround, use t.Cookie validahttps://patchthecve.com/cve/CVE-2026-30837.htmlhttps://patchthecve.com/cve/CVE-2026-30837.htmlWed, 17 Jun 2026 10:33:00 +0000HIGH 7.5: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down signifihttps://patchthecve.com/cve/CVE-2025-66457.htmlhttps://patchthecve.com/cve/CVE-2025-66457.htmlWed, 14 Oct 2026 21:10:00 +0000HIGH 8.8: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie chttps://patchthecve.com/cve/CVE-2025-66456.htmlhttps://patchthecve.com/cve/CVE-2025-66456.htmlWed, 14 Oct 2026 21:10:00 +0000CRITICAL 9.8: Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to