CVE-2026-4926 in path-to-regexp
الملخص
بحسب MITRE • 26/03/2026
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
If you want to get best quality of vulnerability data, you may have to visit VulDB.