PT-2026-24422 · Elysia · Elysia

Edamame-X · Publicado 2026-03-10 · Atualizado 2026-03-10 · CVE-2026-30837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Elysia versions prior to 1.4.26

Description Elysia, a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication, contains a Regular Expression Denial of Service (ReDoS) issue. Specifically, the t.String({ format: 'url' }) function is susceptible to significant slowdowns when provided with a repeated partial URL format (protocol and hostname). This occurs because the regular expression used for URL validation becomes inefficient when processing such input.

Recommendations Update to version 1.4.26 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2026-30837

GHSA-F45G-68Q3-5W8X

Produtos afetados

Elysia

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30837.json · Exploit
• 🔥 https://github.com/EdamAme-x/elysia-poc-redos · Exploit
• https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x · Aviso do Fabricante
• https://github.com/elysiajs/elysia · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30837 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-f45g-68q3-5w8x · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031504129382555846 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30837 · Aviso do Fabricante