Vulnerability in massCode project

[ankitdn]

Describe the bug

While working on massCode project, I identified a security vulnerability in the Elysia framework dependency related to URL format validation. The issue corresponds to CVE-2026-30837, which allows attackers to trigger a Regular Expression Denial of Service (ReDoS) due to inefficient regex handling in URL validation. The vulnerability occurs when specially crafted URL inputs are processed by the regex used

CVE Link
CVE Report

To reproduce

The application experiences significant processing delay, causing CPU spikes and potential service degradation.

App Version and Architecture

Affected dependency: elysia < 1.4.26 Patched version: elysia >= 1.4.26

System info

Node.js: 18.x / 20.x
Package Manager: npm / yarn
Framework: Elysia
OS: Linux / macOS / Windows

Validations

• Follow our Code of Conduct
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion.