Riskcovery

CVE-2026-4926

path-to-regexp vulnerable to Denial of Service via sequential optional groups

State
Published
Severity
7.5 High
Published
Mar 26, 2026
Updated
Sep 17, 2026
Reserved
Mar 26, 2026

Read the record on cve.org

Description

Impact:

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches:

Fixed in version 8.4.0.

Workarounds:

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hopenjs
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat-SADP

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

Affected Products

ProductVersions
path-to-regexppath-to-regexp
  • 8.0.0 to before 8.4.0Affected
  • 8.4.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.