fix(deps): update dependency @elysiajs/cors to v1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@elysiajs/cors	0.7.2 → 1.3.1

---

elysia-cors Origin Validation Error

CVE-2025-50864 / GHSA-f9qj-4c5x-cpcw

More information

Details

An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-50864
• https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts
• https://medium.com/@​raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a
• http://elysiajs.com
• https://github.com/elysiajs/elysia-cors/commit/9b9eb92e32a7a4b43b6d5108668941701c33e221
• https://github.com/elysiajs/elysia-cors/tree/main
• https://github.com/advisories/GHSA-f9qj-4c5x-cpcw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

elysiajs/elysia-cors (@​elysiajs/cors)

v1.3.1

Compare Source

Bug fix:

• strictly check origin not using sub includes

v1.3.0

Compare Source

Change:

• Add support for Elysia 1.3

v1.2.0

Compare Source

Change:

• Add support for Elysia 1.2

v1.1.1

Compare Source

Feature:

• add provenance publish

v1.1.0

Compare Source

Change:

• Add support for Elysia 1.1

v1.0.5

Compare Source

Bug fix:

• fix content-type on preflight

v1.0.4

Compare Source

Bug fix:

• Mirror allow method on preflight options

v1.0.2

Compare Source

Change:

• Add support for Elysia 1.0

v1.0.0

Compare Source

Change:

• Add support for Elysia 1.0

v0.8.0

Compare Source

Change:

• Add support for Elysia 0.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2293870

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to 9b30ce0 in 28 seconds. Click for details.

• Reviewed 16 lines of code in 2 files
• Skipped 0 files when reviewing.
• Skipped posting 2 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. package.json:20

• Draft comment:
  Updated @elysiajs/cors to v1.3.1 to address CVE-2025-50864. Verify no compatibility issues with the new strict origin validation.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% The comment is about a dependency update and asks the author to verify compatibility issues, which violates the rules. It doesn't provide a specific suggestion or point out a specific issue with the code.

2. bun.lockb:1

• Draft comment:
  Lockfile updated; confirm that bun.lockb correctly reflects the dependency changes.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

Workflow ID: wflow_taAWva6sC48KhhRz

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​elysiajs/​cors@​0.7.2 ⏵ 1.3.1		+2	+1	-1

View full report

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request