CVE-2026-30837: Elysia string URL format ReDoS

CVE-2026-30837 · Severity: low · CVSS 3.1 · Published 2026-03-10

Elysia is a web framework for building APIs and applications using TypeBox for schema validation. The URL format validator uses a regular expression vulnerable to regular expression denial of service (ReDoS), where repeated partial URL patterns cause the validation process to slow dramatically, potentially exhausting server resources and causing service outages.

Technologies: elysia (npm). Vendors: npm.

Quick answers

Is CVE-2026-30837 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-30837 being exploited in the wild.
How severe is CVE-2026-30837?
Low severity, with a CVSS score of 3.1, published 10 March 2026.
Which products and versions are affected?
elysia (npm) SEMVER:introduced=0,fixed=1.4.26.
Is there a fix for CVE-2026-30837?
Yes. elysia (npm): upgrade to 1.4.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30837 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-30837?
Check whether you run elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • elysia (npm): upgrade to 1.4.26 or later
    npm install elysia@1.4.26

Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the URL format validator of TypeBox's string type when used with Elysia. The vulnerable regex is triggered when processing strings with repeated partial URL patterns like 'http://a'.repeat(n), causing catastrophic backtracking that increases exponentially with input length (e.g., 33ms for 1024 repeats, 34+ seconds for 32768 repeats). The attack requires network access to submit validation inputs but no authentication or user interaction. An attacker can trigger high CPU consumption and service denial by crafting malicious URLs. The vulnerability is fixed in Elysia version 1.4.26 and later, with significant performance improvements demonstrated in post-patch testing.

Affected products

  • Elysia Elysia < 1.4.26

Identifiers

  • CVE-2026-30837
  • GHSA-f45g-68q3-5w8x

Timeline

  • 2026-03-09: disclosed
  • 2026-03-10: patched: Fixed in version 1.4.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.