CVE-2026-4923mediumCWE-1333

CVE-2026-4923: falha de média gravidade em path-to-regexp

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar path-to-regexp+ Monitorar path-to-regexp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.4%
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
path-to-regexp · path-to-regexp
CVEs relacionadas — path-to-regexp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-4926HIGHpath-to-regexp vulnerable to Denial of Service via sequential optional groupsEPSS 0.8%CVE-2026-4867HIGHpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersEPSS 0.5%