CVE-2026-30837CWE-1333

Elysia has a string URL format redos

High · published March 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.3
In the wild
Unconfirmed
What it is

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00535 · 44.3th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-03-10T20:12Z
EPSS history
Timeline
  • 10 MAR 20:12Z
    Elysia has a string URL format redos
    cvelistv5