CVE-2026-4923 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Attackers can cause denial of service in applications using path-to-regexp by crafting URLs with multiple wildcards that trigger excessive regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4923?
CVE-2026-4923 is a medium-severity denial of service vulnerability in path-to-regexp, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact:
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y
Safe examples:
/*foo-:bar /*foo-:bar-*baz
Patches:
Upgrade to version 8.4.0.
Workarounds:
If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Weakness: CWE-1333
Which versions are affected by CVE-2026-4923?
2 open source packages ship an affected version, including path-to-regexp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
path-to-regexp npm | From 8.0.0 | 8.4.0 |
path-to-regexp npm | From 8.0.0 | 8.4.0 |
Products include Pillarjs Path-to-Regexp.
How do I fix CVE-2026-4923?
Upgrade path-to-regexp to 8.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-4923 being exploited?
There is no known exploitation of CVE-2026-4923 in the wild and no public exploit code.
Other vulnerabilities in path-to-regexp
Sources
Also known as CLEANSTART-2026-AN94003, CLEANSTART-2026-KM38577, DEBIAN-CVE-2026-4923, ECHO-1509-22ad-8ce5, GHSA-27v5-c462-wpq7, MINI-6v7v-889h-vcq9 and 12 more.