Vulnerability Description
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- http://elysiajs.com
- https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts
- https://github.com/elysiajs/elysia-cors/commit/9b9eb92e32a7a4b43b6d5108668941701
- https://github.com/elysiajs/elysia-cors/tree/main
- https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-librar
FAQ
What is CVE-2025-50864?
CVE-2025-50864 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by ...
How severe is CVE-2025-50864?
CVE-2025-50864 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-50864?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.