Description
t.String({ format: 'url' }) is vulnerable to redos
Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly
Here’s a table demonstrating how long it takes to process repeated partial url format | n repeat | elapsed_ms | | — | — | | 1024 | 33.993 | | 2048 | 134.357 | | 4096 | 537.
Recommendation
Update the elysia package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.4.26
- Patched version(s): 1.4.26
References
Could your website be exposed too?
SmartScanner can check your website for Elysia has a string URL format ReDoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- elysia has Inefficient Algorithmic Complexity and Interpretation Conflict - CVE-2026-56669
- DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691
You might also like:
See something that needs correcting? Let us knowUpdated March 10, 2026