CVE-2026-4923: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/foo-bar-:baz /a-:b-c-:d /x/a-:b/c/y
Safe examples:
/foo-:bar /foo-:bar-baz
Patches
Upgrade to version 8.4.0.
Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Other sources
Impact:
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/foo-bar-:baz /a-:b-c-:d /x/a-:b/c/y
Safe examples:
/foo-:bar /foo-:bar-baz
Patches:
Upgrade to version 8.4.0.
Workarounds:
If you are using multiple wildcard parameters, you can check the regex output with a tool such as
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/path-to-regexpto a version that resolves this vulnerability.Fixed in 8.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4923?
CVE-2026-4923 has a medium severity rating due to its potential for Regular Expression Denial of Service (ReDoS) when multiple wildcards are used.
How do I fix CVE-2026-4923?
To fix CVE-2026-4923, update the path-to-regexp package to version 8.4.0 or later.
What software is affected by CVE-2026-4923?
CVE-2026-4923 affects the path-to-regexp package versions below 8.4.0.
Can CVE-2026-4923 be exploited in production environments?
Yes, CVE-2026-4923 can be exploited in production environments, potentially leading to service outages.
What is the cause of CVE-2026-4923?
CVE-2026-4923 is caused by the use of multiple wildcards in regular expressions, leading to excessive backtracking.