What is the CVSS score of CVE-2026-30837?

CVE-2026-30837 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30837?

Yes, a public proof-of-concept exploit is available for CVE-2026-30837. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30837?

Within 24 hours: Identify and inventory all systems running affected OpenAPI versions up to 1.4.26 and assess exposure to untrusted input. Within 7 days: Implement compensating controls including WAF rules to detect malicious regex patterns, enable request rate limiting, and apply network segmentation to limit exposure. Within 30 days: Upgrade to patched version once available from vendor, or migrate to alternative solutions if patch timeline is unacceptable.

Elysia CVE-2026-30837

Q: Which versions of Elysia are affected by CVE-2026-30837?

A high-severity denial-of-service vulnerability exists in OpenAPI documentation and client-server communication affecting versions up to 1.4.26.. A patch is available.

HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-03-10 security-advisories@github.com

GHSA-f45g-68q3-5w8x

Denial Of Service Elysia

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 20, 2026 - 15:23 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 21:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on elysia (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.4.26.

DescriptionGitHub Advisory

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.

AnalysisAI

OpenAPI documentation and client-server communication. versions up to 1.4.26 is affected by inefficient regular expression complexity (redos) (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-1333: Inefficient Regular Expression Complexity (ReDoS)) affects OpenAPI documentation and client-server communication.. Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Prior to 1.4.26 , t.String({ format: 'url' }) is vulnerable to ReDoS. Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly. This vulnerability is fixed in 1.4.26.