{"id":"CVE-2026-4867","published":"2026-03-26T16:16:25Z","modified":"2026-03-26T16:52:14Z","title":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","vendor":"path-to-regexp","product":"path-to-regexp","tier":"tail","description":{"text":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00515,"percentile":0.43759,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://github.com/advisories/GHSA-9wv6-86v2-598j","tags":[]},{"url":"https://blakeembrey.com/posts/2024-09-web-redos","tags":[]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]}],"priority":{"score":14.0,"factors":[{"name":"EPSS percentile","points":8.75},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"path-to-regexp","affectedVersions":[{"vendor":"path-to-regexp","product":"path-to-regexp","versions":["< 0.1.13"]}],"affected":[{"ecosystem":"npm","package":"path-to-regexp","vulnerableRanges":["<0.1.13"],"patched":["0.1.13"],"from":["GHSA-37ch-88jc-xwx2"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-16273","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pillarjs-path-to-regexp-cve-2024-45296","parents":[{"from":"CVE-2024-45296","to":"CVE-2026-4867","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-9wv6-86v2-598j","via":"reference","url":"https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j"},{"kind":"osv-related","provenance":"source","id":"GHSA-37ch-88jc-xwx2","via":"reference","url":"https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2"}]},{"from":"CVE-2024-45813","to":"CVE-2026-4867","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-rrr8-f88r-h8q6","via":"reference","url":"https://github.com/advisories/GHSA-9wv6-86v2-598j"}]}],"packageHistory":[{"cve":"CVE-2024-52798","published":"2024-12-05","fixed":"0.1.12","kev":false,"link":{"from":"CVE-2024-52798","to":"CVE-2026-4867","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:path-to-regexp","fromFixed":"0.1.12","toFixed":"0.1.13","daysApart":476}]}},{"cve":"CVE-2026-4867","published":"2026-03-26","fixed":"0.1.13","kev":false},{"cve":"CVE-2024-45296","published":"2024-09-09","fixed":"8.0.0","kev":false},{"cve":"CVE-2026-4923","published":"2026-03-26","fixed":"8.4.0","kev":false},{"cve":"CVE-2026-4926","published":"2026-03-26","fixed":"8.4.0","kev":false}],"package":"npm:path-to-regexp"}}