CVE-2026-4923
Regular Expression ReDoS in Wildcard Path Parameters (v
Publication date: 2026-03-26
Last updated on: 2026-04-16
Assigner: openjs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pillarjs | path-to-regexp | From 8.0.0 (inc) to 8.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the regular expression output generated from your wildcard parameters to see if it is vulnerable to ReDoS.
A suggested method is to use an online tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path with multiple wildcard parameters is vulnerable.
No specific commands are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade to version 8.4.0 where the issue is patched.
As a workaround, if you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
How can this vulnerability impact me? :
This vulnerability can lead to a denial of service (DoS) condition by exploiting the backtracking behavior of the generated regular expressions.
An attacker can craft input that causes excessive processing time, potentially making the affected system unresponsive or significantly degraded in performance.
Can you explain this vulnerability to me?
This vulnerability occurs when multiple wildcards are used in combination with at least one parameter in a path, which can generate a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS).
The issue arises because the backtracking in the regular expression can be exploited, especially when the second wildcard is located somewhere other than at the end of the path.
Unsafe examples of vulnerable paths include patterns like /*foo-*bar-:baz, /*a-:b-*c-:d, and /x/*a-:b/*c/y, whereas safe examples include /*foo-:bar and /*foo-:bar-*baz.