medium5.9
CVE-2026-4923
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS.
Impact
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | path-to-regexp | >= 8.0.0, < 8.4.0 | 8.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pillarjs | Path-To-Regexp | from 8.0.0 before 8.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-27v5-c462-wpq7
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7
- https://nvd.nist.gov/vuln/detail/CVE-2026-4923
- https://cna.openjsf.org/security-advisories.html
- https://makenowjust-labs.github.io/recheck/playground