CVE-2026-30837
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Mar 10, 2026
CISA due date
—
The record
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | elysia | 0 | 1.4.26 |
Related vulnerabilities
- GHSA-f45g-68q3-5w8x Elysia has a string URL format ReDoS Same vulnerability
- CVE-2026-31865 Elysia is a Typescript framework for request validation, type inference, OpenAPI… Also affects elysia
- GHSA-8hq9-phh3-p2wp Elysia Cookie Value Prototype Pollution Also affects elysia
- CVE-2025-66457 Elysia affected by arbitrary code injection through cookie config Also affects elysia
- CVE-2025-66456 Elysia vulnerable to prototype pollution with multiple standalone schema validation Also affects elysia
- GHSA-8vch-m3f4-q8jf Elysia affected by arbitrary code injection through cookie config Also affects elysia
- GHSA-hxj9-33pp-j2cc Elysia vulnerable to prototype pollution with multiple standalone schema validation Also affects elysia
- CVE-2026-112901 Pillow is a Python imaging library. CWE-1333