GitHub Advisoryadvisory · npm

GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups

HIGH Published 2026-03-27 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-4926
Ecosystem
npm
Packages
path-to-regexp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2026-03-27

Affected packages

• npm path-to-regexp: >= 8.0.0, < 8.4.0 → fixed in 8.4.0

Description

Impact A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches Fixed in version 8.4.0. Workarounds Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Related

Alias · CVE (1)

  • CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as… vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References