CVE-2026-30837 Elysia has a string URL format redos
Attackers can cause denial of service in Elysia applications by sending crafted URLs that trigger excessive CPU usage in the URL validation regex.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30837?
CVE-2026-30837 is a high-severity denial of service vulnerability in elysiajs elysia, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.
Weakness: CWE-1333
Which versions are affected by CVE-2026-30837?
2 open source packages ship an affected version, including elysia. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elysia npm | All versions | 1.4.26 |
elysia npm | All versions | 1.4.26 |
Products include Elysiajs Elysia.
How do I fix CVE-2026-30837?
Upgrade elysia to 1.4.26 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-30837 being exploited?
There is no known exploitation of CVE-2026-30837 in the wild and no public exploit code.
Other vulnerabilities in elysiajs elysia
Sources
Also known as GHSA-f45g-68q3-5w8x.