# CVE-2026-30837: Elysia string URL format ReDoS

Source: https://junglewise.ai/threats/cve-2026-30837-elysia-string-url-format-redos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30837 · Severity: low · CVSS 3.1 · Published 2026-03-10

Elysia is a web framework for building APIs and applications using TypeBox for schema validation. The URL format validator uses a regular expression vulnerable to regular expression denial of service (ReDoS), where repeated partial URL patterns cause the validation process to slow dramatically, potentially exhausting server resources and causing service outages.

Technologies: [elysia (npm)](https://junglewise.ai/threats/technologies/npm-elysia). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-30837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30837 being exploited in the wild.

**How severe is CVE-2026-30837?** Low severity, with a CVSS score of 3.1, published 10 March 2026.

**Which products and versions are affected?** elysia (npm) SEMVER:introduced=0,fixed=1.4.26.

**Is there a fix for CVE-2026-30837?** Yes. elysia (npm): upgrade to 1.4.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30837 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30837?** Check whether you run elysia (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- elysia (npm): upgrade to 1.4.26 or later

  ```sh
  npm install elysia@1.4.26
  ```


## Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the URL format validator of TypeBox's string type when used with Elysia. The vulnerable regex is triggered when processing strings with repeated partial URL patterns like 'http://a'.repeat(n), causing catastrophic backtracking that increases exponentially with input length (e.g., 33ms for 1024 repeats, 34+ seconds for 32768 repeats). The attack requires network access to submit validation inputs but no authentication or user interaction. An attacker can trigger high CPU consumption and service denial by crafting malicious URLs. The vulnerability is fixed in Elysia version 1.4.26 and later, with significant performance improvements demonstrated in post-patch testing.

## Affected products

- Elysia Elysia < 1.4.26

## Identifiers

- CVE-2026-30837
- GHSA-f45g-68q3-5w8x

## Timeline

- 2026-03-09: disclosed
- 2026-03-10: patched: Fixed in version 1.4.26

## References

- [https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x](https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x)

## Related threats

- [Elysia denial of service via quadratic complexity in form data normalization](https://junglewise.ai/threats/cve-2026-56669-elysia-denial-of-service-via-quadratic-complexity-in-form-data)
- [Elysia cookie value prototype pollution](https://junglewise.ai/threats/cve-2026-31865-elysia-cookie-value-prototype-pollution)
- [Elysia arbitrary code injection through cookie config](https://junglewise.ai/threats/cve-2025-66457-elysia-arbitrary-code-injection-through-cookie-config)
- [Elysia prototype pollution in schema validation](https://junglewise.ai/threats/cve-2025-66456-elysia-prototype-pollution-in-schema-validation)