Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-4926

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
openjs

Description

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

path-to-regexp path-to-regexp

Default version status: unaffected

  • 8.0.0 to < 8.4.0affected
  • 8.4.0unaffected
pkg:npm/path-to-regexp

References