CVE-2026-4926 Details

A denial-of-service vulnerability has been identified in the 'path-to-regexp' project, specifically in version 8.4.0. The issue arises from the generation of inefficient regular expressions when multiple sequential optional groups are used in route patterns. This flaw causes the regex processing to become exponentially more complex with the addition of each group, leading to significant performance degradation. The vulnerability can be exploited by crafting route patterns that include several sequential optional groups, particularly those that are user-controlled.

Users can upgrade to 'path-to-regexp' version 8.4.0 or later to address this vulnerability. Additionally, it is recommended to limit the use of sequential optional groups in route patterns and to avoid using user-controlled input as route patterns.