path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Description

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters.

Recommendation

Update the path-to-regexp package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.13
• Patched version(s): 0.1.13

References

• GHSA-37ch-88jc-xwx2
• blakeembrey.com
• cna.openjsf.org
• CVE-2026-4867
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• path-to-regexp vulnerable to Denial of Service via sequential optional groups - CVE-2026-4926
• angular vulnerable to regular expression denial of service via the <input type="url"> element - CVE-2023-26118
• angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

path-to-regexp