GHSA-j3q9-mxjg-w52f (CVE-2026-4926)

Details

Impact

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches

Fixed in version 8.4.0.

Workarounds

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected Packages

path-to-regexp

npm

Fixed in:

8.4.0

References

WEB

https://cna.openjsf.org/security-advisories.html

ADVISORY

https://github.com/advisories/GHSA-j3q9-mxjg-w52f

PACKAGE

https://github.com/pillarjs/path-to-regexp

WEB

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2026-4926