Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 10, 2026 · NIST NVD

   Detected

   Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.

2. Jun 17, 2026 · NIST NVD

   Updated

   Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.

Affected

• cpe elysiajs/elysiaversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-30837

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-30837

  Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex

  nvd.nist.gov

References

• Exploit · github.com
• Mitigation · github.com