CVE-2026-4923 — Regex Denial of Service in Path-to-regexp

CWE-1333 — Regex Denial of Service13 documents7 sources
Severity
5.9MEDIUMNVD
EPSS
0.1%
top 83.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Path-to-regexpDebian Node-path-to-regexp
Timeline
PublishedMar 26
Latest updateMar 30

Description

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a too…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/node-path-to-regexp< node-path-to-regexp 8.4.0-1 (forky)
▶CVEListV5path-to-regexp/path-to-regexp8.0.0 — 8.4.0
▶npmpath-to-regexp/path-to-regexp8.0.0 — 8.4.0

🔴Vulnerability Details

3
OSV
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards↗2026-03-27
▶
GHSA
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards↗2026-03-27
▶
OSV
CVE-2026-4923: Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS↗2026-03-26
▶

📋Vendor Advisories

2
Red Hat
path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards↗2026-03-26
▶
Debian
CVE-2026-4923: node-path-to-regexp - Impact: When using multiple wildcards, combined with at least one parameter, a ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-4923 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

6
Bugzilla
CVE-2026-4923 cachelib: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards [epel-all]↗2026-03-30
▶
Bugzilla
CVE-2026-4923 fbthrift: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards [epel-all]↗2026-03-30
▶
Bugzilla
CVE-2026-4923 openbao: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards [epel-all]↗2026-03-30
▶
Bugzilla
CVE-2026-4923 cachelib: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards [fedora-all]↗2026-03-30
▶
Bugzilla
CVE-2026-4923 openbao: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards [fedora-all]↗2026-03-30
▶