path-to-regexp vulnerable to Denial of Service via sequential optional groups

Description

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.

Recommendation

Update the path-to-regexp package to the latest compatible version. Followings are version details:

• Affected version(s): >= 8.0.0, < 8.4.0
• Patched version(s): 8.4.0

References

• GHSA-j3q9-mxjg-w52f
• cna.openjsf.org
• CVE-2026-4926
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
• Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

path-to-regexp