CVE-2026-4867 Details
Description
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
A regular expression denial-of-service (ReDoS) vulnerability has been identified in the path-to-regexp library, which is used in frameworks like Express.js and Next.js. This vulnerability arises when two or more parameters are placed within a single segment of a route, separated by a character other than a period. The issue is caused by the generated regular expression allowing for catastrophic backtracking, which can be exploited to create a significant performance hit. For instance, the route '/flights/:from-:to' can be manipulated to cause a delay of up to 300 milliseconds, compared to a safe version of the route that takes only 0.07 milliseconds.
Users of path-to-regexp version 0.1 should upgrade to version 0.1.10. All other users should upgrade to version 8.0.0, which removes the features that can lead to a ReDoS vulnerability. If an upgrade is not possible, the vulnerability can be mitigated by manually defining safe regular expressions for parameters in vulnerable routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blakeembrey.com/posts/2024-09-web-redos | openjs | Technical Description |
| https://cna.openjsf.org/security-advisories.html | openjs | Third Party Advisory |
| https://github.com/advisories/GHSA-9wv6-86v2-598j | openjs | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | openjs |
Affected Products
| Product | Versions |
|---|---|
| pillarjs path-to-regexp | < 0.1.13 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | openjs |