Alert IDs:
- 56f8a26d-6c2b-4f37-818c-cea2f55f076c
- 9ccff62a-412c-48eb-85e7-21a7d00d4380
Vulnerabilities in path-to-regexp
Release: New release
Total Vulnerabilities: 2
Severity: MEDIUM (Score: 4.7)
Description:
Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y
Safe examples:
/*foo-:bar
/*foo-:bar-*baz
Patches
Upgrade to version 8.4.0.
Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4923
Alert ID: 56f8a26d-6c2b-4f37-818c-cea2f55f076c
Severity: HIGH (Score: 5.9)
Description:
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4926
Alert ID: 9ccff62a-412c-48eb-85e7-21a7d00d4380
Alert IDs:
Vulnerabilities in path-to-regexp
Release: New release
Total Vulnerabilities: 2
1. CVE-2026-4923
Severity: MEDIUM (Score: 4.7)
Description:
Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
Safe examples:
Patches
Upgrade to version
8.4.0.Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4923
Alert ID: 56f8a26d-6c2b-4f37-818c-cea2f55f076c
2. CVE-2026-4926
Severity: HIGH (Score: 5.9)
Description:
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as
{a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4926
Alert ID: 9ccff62a-412c-48eb-85e7-21a7d00d4380