Alert IDs:
- 6a7e9a8c-fa38-4bd5-acb9-8bcaeba0bfb5
- 8839371f-eac9-419b-95fc-7443695a8eaa
Vulnerabilities in path-to-regexp
Release: New release
Total Vulnerabilities: 2
Severity: HIGH (Score: 5.9)
Description:
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4926
Alert ID: 6a7e9a8c-fa38-4bd5-acb9-8bcaeba0bfb5
Severity: MEDIUM (Score: 4.7)
Description:
Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y
Safe examples:
/*foo-:bar
/*foo-:bar-*baz
Patches
Upgrade to version 8.4.0.
Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4923
Alert ID: 8839371f-eac9-419b-95fc-7443695a8eaa
Alert IDs:
Vulnerabilities in path-to-regexp
Release: New release
Total Vulnerabilities: 2
1. CVE-2026-4926
Severity: HIGH (Score: 5.9)
Description:
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as
{a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4926
Alert ID: 6a7e9a8c-fa38-4bd5-acb9-8bcaeba0bfb5
2. CVE-2026-4923
Severity: MEDIUM (Score: 4.7)
Description:
Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
Safe examples:
Patches
Upgrade to version
8.4.0.Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4923
Alert ID: 8839371f-eac9-419b-95fc-7443695a8eaa