PT-2026-24625 · Npm · Elysia

Published

2026-03-10

·

Updated

2026-03-10

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

t.String({ format: 'url' }) is vulnerable to redos
Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly
'http://a'.repeat(n)
Here's a table demonstrating how long it takes to process repeated partial url format
n repeatelapsed ms
102433.993
2048134.357
4096537.608
81922155.842
163848618.457
3276834604.139

Patches

Patched by 1.4.26, please kindly update elysia to >= 1.4.26
Here's how long it takes after the patch
n repeatelapsed ms
10240.194
20480.274
40960.455
81920.831
163841.632
327683.052

Workarounds

  1. It's recommended to always limit URL format to a reasonable length
t.String({
	format: 'url',
	maxLength: 288
})
  1. If a long URL format is necessary, to patch this without updating to 1.4.26, add the following code to any part of your codebase
import { FormatRegistry } from '@sinclair/typebox'

FormatRegistry.Delete('url')
FormatRegistry.Set('url', (value) =>
	/^(?:https?|ftp)://(?:[^s:@]+(?::[^s@]*)?@)?(?:(?!(?:10|127)(?:.d{1,3}){3})(?!(?:169.254|192.168)(?:.d{1,3}){2})(?!172.(?:1[6-9]|2d|3[0-1])(?:.d{1,3}){2})(?:[1-9]d?|1dd|2[01]d|22[0-3])(?:.(?:1?d{1,2}|2[0-4]d|25[0-5])){2}(?:.(?:[1-9]d?|1dd|2[0-4]d|25[0-4]))|(?:(?:[a-z0-9u{00a1}-u{ffff}]+-)*[a-z0-9u{00a1}-u{ffff}]+)(?:.(?:[a-z0-9u{00a1}-u{ffff}]+-)*[a-z0-9u{00a1}-u{ffff}]+)*(?:.(?:[a-zu{00a1}-u{ffff}]{2,})))(?::d{2,5})?(?:/[^s]*)?$/iu.test(
		value
	)
)

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

GHSA-F45G-68Q3-5W8X

Affected Products

Elysia