GHSA-27v5-c462-wpq7
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
At a glance
- Published
- Updated
- CVE
- CVE-2026-4923
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. **Unsafe examples:** ``` /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y ``` **Safe examples:** ``` /*foo-:bar /*foo-:bar-*baz ``` ### Patches Upgrade to version `8.4.0`. ### Workarounds If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Affected packages
| Package | Versions |
|---|---|
| npm · path-to-regexp | introduced 8.0.0, fixed 8.4.0 |
References
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-4923 ADVISORY
- https://cna.openjsf.org/security-advisories.html WEB
- https://github.com/pillarjs/path-to-regexp PACKAGE
- https://makenowjust-labs.github.io/recheck/playground WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |