Executive brief
Elysia is a web framework for building APIs and applications using TypeBox for schema validation. The URL format validator uses a regular expression vulnerable to regular expression denial of service (ReDoS), where repeated partial URL patterns cause the validation process to slow dramatically, potentially exhausting server resources and causing service outages.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) in the URL format validator of TypeBox's string type when used with Elysia. The vulnerable regex is triggered when processing strings with repeated partial URL patterns like 'http://a'.repeat(n), causing catastrophic backtracking that increases exponentially with input length (e.g., 33ms for 1024 repeats, 34+ seconds for 32768 repeats). The attack requires network access to submit validation inputs but no authentication or user interaction. An attacker can trigger high CPU consumption and service denial by crafting malicious URLs. The vulnerability is fixed in Elysia version 1.4.26 and later, with significant performance improvements demonstrated in post-patch testing.
Affected products
- Elysia Elysia < 1.4.26
Timeline
- 2026-03-09: disclosed
- 2026-03-10: patched: Fixed in version 1.4.26