CVE-2026-4926: path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Other sources
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/path-to-regexpto a version that resolves this vulnerability.Fixed in 8.4.0 - Upgrade
Upgrade
path-to-regexpto a version that resolves this vulnerability.Fixed in 8.4.0 - Configuration
Avoid generating route patterns that contain multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`; instead limit the number of sequential optional groups in route patterns to prevent denial of service.
route pattern handling sequential optional groups in route patterns = Limit the number of sequential optional groups - Configuration
Avoid passing user-controlled input as route patterns.
route pattern handling route pattern input source = Do not pass user-controlled input as route patterns
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4926?
CVE-2026-4926 has a high severity due to its potential to cause Denial of Service through poorly formed regular expressions.
How do I fix CVE-2026-4926?
To fix CVE-2026-4926, upgrade the path-to-regexp library to version 8.4.0 or later.
What versions of path-to-regexp are affected by CVE-2026-4926?
Versions of path-to-regexp from 8.0.0 up to but not including 8.4.0 are affected by CVE-2026-4926.
What impact does CVE-2026-4926 have on applications?
CVE-2026-4926 can lead to CPU exhaustion in applications using vulnerable versions, resulting in Denial of Service.
What type of vulnerability is CVE-2026-4926?
CVE-2026-4926 is a vulnerability related to Denial of Service caused by inefficient regex processing.