What’s Vulnerable › Vulnerabilities
CVE-2026-4923: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-26 · updated 2026-06-17
- Weakness: CWE-1333
Description
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Affected products
- path-to-regexp: from 8.0.0 before 8.4.0 — fixed in 8.4.0
How to fix
Upgrade to a fixed version: path-to-regexp 8.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-4923 or the next vulnerability affects your stack