{"id":"CVE-2026-4923","aliases":["DEBIAN-CVE-2026-4923","EUVD-2026-16322","GHSA-27v5-c462-wpq7","ROOT-APP-NPM-CVE-2026-4923","UBUNTU-CVE-2026-4923"],"status":"published","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards","description":"Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00359,"percentile":0.29966,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-03-26T19:02:00Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"npm","package":"path-to-regexp","fixed_in":["8.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-path-to-regexp","fixed_in":["8.4.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"path-to-regexp","fixed_in":["8.3.0-aikido.3","8.3.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/path-to-regexp","fixed_in":["8.3.0-root.io.3","8.3.0-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-1","6.3.0-1","8.3.0-1","8.4.0-1","8.4.1-1","8.4.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-1","8.3.0-1","8.4.0-1","8.4.1-1","8.4.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-1"}]}],"versions":["6.3.0-1","8.3.0-1"]},{"source":"osv","ecosystem":"npm","package":"path-to-regexp","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.4.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.0-aikido.3"},{"fixed":"8.3.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/path-to-regexp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.0-root.io.3"},{"fixed":"8.3.0-root.io.4"}]}]}],"products":[{"vendor":"path-to-regexp","product":"path-to-regexp"},{"vendor":"pillarjs","product":"path-to-regexp"}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4923","tags":["advisory"]},{"url":"https://makenowjust-labs.github.io/recheck/playground","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27v5-c462-wpq7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4923.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4923","tags":["advisory"]},{"url":"https://github.com/pillarjs/path-to-regexp","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-4923","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4923","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-4923","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards","description":"Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-26T19:02:00.729Z","modified":"2026-03-27T13:58:03.925Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-16322","description":"Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-26T19:02:00Z","modified":"2026-03-27T13:58:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-27v5-c462-wpq7","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards","description":"### Impact\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\n**Unsafe examples:**\n\n```\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n```\n\n**Safe examples:**\n\n```\n/*foo-:bar\n/*foo-:bar-*baz\n```\n\n### Patches\n\nUpgrade to version `8.4.0`.\n\n### Workarounds\n\nIf developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-27T22:23:52Z","modified":"2026-03-27T22:23:55Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:44.97342Z"}],"nvd":[{"id":"CVE-2026-4923","description":"Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-26T19:17:08.187Z","modified":"2026-06-17T10:57:27.74Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-4923","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards","description":"Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-26T19:02:00.729Z","modified":"2026-10-28T02:31:07.027438479Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-4923","description":"Impact:  When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.  Unsafe examples:  /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y  Safe examples:  /*foo-:bar /*foo-:bar-*baz  Patches:  Upgrade to version 8.4.0.  Workarounds:  If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-26T19:17:08.187Z","modified":"2026-10-01T03:03:16.524296305Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-27v5-c462-wpq7","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards","description":"### Impact\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\n**Unsafe examples:**\n\n```\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n```\n\n**Safe examples:**\n\n```\n/*foo-:bar\n/*foo-:bar-*baz\n```\n\n### Patches\n\nUpgrade to version `8.4.0`.\n\n### Workarounds\n\nIf developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"published","published":"2026-03-27T22:23:52Z","modified":"2026-09-10T03:50:36.174856756Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"ROOT-APP-NPM-CVE-2026-4923","title":"CVE-2026-4923 in path-to-regexp - Patched by Root","description":"Root has patched CVE-2026-4923 in the path-to-regexp package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-16T09:32:56Z","modified":"2026-08-16T11:00:04.196280579Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-4923","description":"Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.","status":"withdrawn","published":"2026-03-26T19:17:00Z","modified":"2026-05-21T12:15:26.490223547Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"}]}}