CVE-2026-4923

NameCVE-2026-4923
DescriptionImpact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1132020

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-path-to-regexp (PTS)bullseye6.2.0-1vulnerable
bookworm6.2.1-1vulnerable
trixie6.3.0-1vulnerable
forky, sid8.3.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-path-to-regexpsource(unstable)8.4.0-11132020

Notes

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7

Search for package or bug name: Reporting problems