AIKIDO-2026-654904

TL;DR

Elysia normalizes multipart/form-data request bodies by iterating over the form keys and calling getAll for each key. Because getAll performs a full linear scan of every entry on each call, the normalization work grows quadratically with the number of key-value pairs. An unauthenticated attacker can send a small crafted multipart request containing many distinct field names to force the server to perform a very large number of comparisons and exhaust CPU on the event-loop thread. The fix replaces the nested getAll calls with a single linear pass that groups values by key.