CVE-2026-30837: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30837 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Elysia web framework's URL string format validator (t.String({ format: 'url' })). Discovered and reported by researcher EdamAme-x, it was published on March 9, 2026, and affects all Elysia versions below 1.4.26 for Node.js. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Elysia Advisory).

The root cause is an inefficient regular expression (CWE-1333) used in Elysia's URL format validation, located in src/formats.ts and src/type-system/format.ts. When an attacker submits input consisting of a repeated partial URL pattern (protocol and hostname, e.g., 'http://a'.repeat(n)), the regex engine undergoes catastrophic backtracking, causing processing time to grow exponentially — from ~34ms at n=1024 to over 34 seconds at n=32768. No authentication or special privileges are required; any endpoint that applies t.String({ format: 'url' }) validation is susceptible (Elysia Advisory, PoC Repository).

Successful exploitation causes excessive CPU consumption on the server, rendering the application unresponsive or causing it to crash — a pure availability impact with no confidentiality or integrity consequences. Because the attack requires only a single crafted HTTP request with no authentication, a single attacker can effectively deny service to all legitimate users of any Elysia application that uses URL format validation. There is no risk of data exfiltration or lateral movement from this vulnerability alone (Github Advisory, Feedly).

A public proof-of-concept (PoC) exploit written in JavaScript is available at the elysia-poc-redos GitHub repository, which includes a runnable script (poc-url-format-redos.mjs) demonstrating the vulnerability via bun run poc. The EPSS score is approximately 0.013% (0.027% per GitHub Advisory), indicating low current exploitation probability, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (PoC Repository, Github Advisory).

1. Reconnaissance: Identify web applications built with Elysia (Node.js/Bun framework) that expose endpoints accepting URL-formatted string inputs validated with t.String({ format: 'url' }). This can be done by reviewing API documentation, JavaScript source maps, or error messages revealing the framework.
2. Craft malicious payload: Construct an HTTP request body or query parameter containing a repeated partial URL string, e.g., 'http://a'.repeat(8192) (~65KB), which triggers catastrophic backtracking in the vulnerable regex.
3. Send the request: Submit the crafted payload to any endpoint on the target Elysia application that performs URL format validation. No authentication token or special headers are required.
4. Observe denial of service: The server's event loop becomes blocked processing the regex match, causing the application to become unresponsive for several seconds per request. Repeating the request sustains the denial of service condition (Elysia Advisory, PoC Repository).

• Network: Incoming HTTP requests with unusually large URL-format field values (tens of kilobytes) in request bodies or query parameters targeting Elysia API endpoints; repeated requests from the same source IP with large payloads.
• Logs: Application logs showing significantly elevated request processing times or timeouts for endpoints using URL validation; Bun/Node.js process logs indicating event loop lag or unresponsiveness.
• Process: Sustained high CPU utilization (near 100%) on the Bun or Node.js process serving the Elysia application, particularly correlated with incoming requests; application health checks failing during attack windows.

Upgrade Elysia to version 1.4.26 or later, which replaces the vulnerable regex with an efficient alternative (processing time remains linear, e.g., ~3ms at n=32768 vs. ~34 seconds before the patch). As an immediate workaround without upgrading, restrict URL input length using t.String({ format: 'url', maxLength: 288 }). Alternatively, replace the vulnerable URL format validator by overriding it via the TypeBox FormatRegistry with the patched regex provided in the advisory. Additionally, implement request size limits and rate limiting on endpoints that trigger URL validation (Elysia Advisory, Github Advisory).

The vulnerability was published by Elysia maintainer SaltyAom and credited to reporter EdamAme-x, who also provided the public PoC. Community discussion has been limited, with a Bluesky post noted in threat intelligence feeds. No major media coverage or significant researcher commentary beyond the advisory and PoC repository has been identified (Github Advisory, PoC Repository).