NetSight
IP …
high7.5

CVE-2026-4926

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.

Impact

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected packages

EcosystemPackageAffectedFixed in
npmpath-to-regexp>= 8.0.0, < 8.4.08.4.0

Affected products

VendorProductAffected versions
PillarjsPath-To-Regexp
from 8.0.0 before 8.4.0

Weakness classification

CWE-400CWE-1333

References