Kurz gesagt
- CVE-2026-4926 ist eine Schwachstelle (HOCH (CVSS 7.5)) in path-to-regexp (pillarjs), path-to-regexp.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.80%, höher als bei 56.9% aller Schwachstellen.
- Abhilfe: auf 8.4.0 oder neuer aktualisieren.
Description
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
NVD description
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free