PT-2026-24422 · Elysia · Elysia

Edamame-X · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-30837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Elysia versions prior to 1.4.26

Description Elysia, a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication, contains a Regular Expression Denial of Service (ReDoS) issue. Specifically, the t.String({ format: 'url' }) function is susceptible to significant slowdowns when provided with a repeated partial URL format (protocol and hostname). This occurs because the regular expression used for URL validation becomes inefficient when processing such input.

Recommendations Update to version 1.4.26 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-30837

GHSA-F45G-68Q3-5W8X

Affected Products

Elysia

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30837.json · Exploit
• 🔥 https://github.com/EdamAme-x/elysia-poc-redos · Exploit
• https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30837 · Security Note
• https://osv.dev/vulnerability/GHSA-f45g-68q3-5w8x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30837 · Vendor Advisory
• https://github.com/elysiajs/elysia · Note
• https://twitter.com/CVEnew/status/2031504129382555846 · Twitter Post