CVE-2026-4926 — path-to-regexp vulnerable to Denial of Service via sequential optional groups

Description (CNA)

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected (CNA)

Vendor / product	Versions
path-to-regexp / path-to-regexp	affected 8.0.0 before 8.4.0; unaffected 8.4.0

CWE

CWE-400, CWE-1333

References

https://cna.openjsf.org/security-advisories.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.