5.9Mittel
CVE-2026-4923path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Beschreibung
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Schwachstellentyp (CWE):
CWE-1333
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| path-to-regexp | path-to-regexp | 8.0.0 – < 8.4.0, fixed 8.4.0 | |
| pillarjs | path-to-regexp | 8.0.0 – < 8.4.0 |
Referenzen und Patches
- https://cna.openjsf.org/security-advisories.html Third Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.4.0