Description
t.String({ format: 'url' }) is vulnerable to redos
Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly
Here’s a table demonstrating how long it takes to process repeated partial url format | n repeat | elapsed_ms | | — | — | | 1024 | 33.993 | | 2048 | 134.357 | | 4096 | 537.
Recommendation
Update the elysia package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.4.26
- Patched version(s): 1.4.26
References
Could your website be exposed too?
SmartScanner can check your website for Elysia has a string URL format ReDoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
You might also like:
See something that needs correcting? Let us knowUpdated March 10, 2026