fix(deps): update dependency elysia to v1.4.27 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
elysia	1.4.22 → 1.4.27

---

Elysia has a string URL format ReDoS

CVE-2026-30837 / GHSA-f45g-68q3-5w8x

More information

Details

Impact

t.String({ format: 'url' }) is vulnerable to redos

Repeating a partial url format (protocol and hostname) multiple times cause regex to slow down significantly

'http://a'.repeat(n)

Here's a table demonstrating how long it takes to process repeated partial url format

n repeat	elapsed_ms
1024	33.993
2048	134.357
4096	537.608
8192	2155.842
16384	8618.457
32768	34604.139

Patches

Patched by 1.4.26, please kindly update elysia to >= 1.4.26

Here's how long it takes after the patch

n repeat	elapsed_ms
1024	0.194
2048	0.274
4096	0.455
8192	0.831
16384	1.632
32768	3.052

Workarounds

1. It's recommended to always limit URL format to a reasonable length

t.String({
	format: 'url',
	maxLength: 288
})

2. If a long URL format is necessary, to patch this without updating to 1.4.26, add the following code to any part of your codebase

import { FormatRegistry } from '@sinclair/typebox'

FormatRegistry.Delete('url')
FormatRegistry.Set('url', (value) =>
	/^(?:https?|ftp):\/\/(?:[^\s:@]+(?::[^\s@]*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)(?:\.(?:[a-z0-9\u{00a1}-\u{ffff}]+-)*[a-z0-9\u{00a1}-\u{ffff}]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu.test(
		value
	)
)

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/elysiajs/elysia/security/advisories/GHSA-f45g-68q3-5w8x
• https://github.com/EdamAme-x/elysia-poc-redos
• https://nvd.nist.gov/vuln/detail/CVE-2026-30837
• https://github.com/advisories/GHSA-f45g-68q3-5w8x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Elysia Cookie Value Prototype Pollution

CVE-2026-31865 / GHSA-8hq9-phh3-p2wp

More information

Details

Impact

Elysia cookie can be overridden by prototype pollution , eg. __proto__

Sending cookie with the follows name can override cookie value:

__proto__=%7B%22injected%22%3A%22polluted%22%7D

Patches

Patched by 1.4.27

Workarounds

1. Use t.Cookie validation to enforce validation value
2. Prevent iterable over cookie if possible

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp
• https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab
• https://nvd.nist.gov/vuln/detail/CVE-2026-31865
• https://github.com/advisories/GHSA-8hq9-phh3-p2wp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

elysiajs/elysia (elysia)

v1.4.27

Compare Source

Bug fix:

• getSchemaValidator: handle TypeBox as sub type
• handle cookie prototype pollution when parsing cookie

Improvement:

• conditional async on getSchemaValidator when schema is Standard Schema
• use Response.json on Bun

v1.4.26

Compare Source

Bug fix:

• #​1755 deduplicate local handler from global event
• #​1752 system router with trailing path doesn't match with non-trailing
• url format redos
• #​1747 parsing request from mount hang

v1.4.25

Compare Source

Feature:

• export ElysiaStatus

Bug fix:

• macro with conflict literal value per status
• recursive macro with conflict value per status

v1.4.24

Compare Source

Feature:

• graceful unsigned cookie transition

Bug fix:

• #​1733 preserve multiple set-cookie headers in mounted handlers
• object cookie with secret doesn't deserialized after parsed

v1.4.23

Compare Source

Feature:

• #​1719 add t.Union/t.Intersection handling in property enumerations/checks
• #​1697 extend complex formdata support to StandardSchema
• #​1656 serialize custom array-like custom class with array sub class

Bug fix:

• #​1721 Promise with response schema
• #​1700 distinct union object
• #​1683 response validation returns 500 instead of 422 for nested schemas in dynamic mode
• #​1679 preserve headers when throwing from AsyncGenerator
• #​1595 stream reference should point to teed value
• fix can't modify immutable headers error

Change:

• update exact-mirror to 0.2.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Summary by cubic

Updates elysia from 1.4.22 to 1.4.27 to fix two security vulnerabilities: a ReDoS in URL string format validation and a prototype pollution issue with cookie values.

^{Written for commit e6aa79d. Summary will update on new commits.}