path-to-regexp vulnerable to Denial of Service via sequential optional groups
Priority MEDIUM 40CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 15 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00805 57th percentileScored 2026-11-07
Fix Partial path-to-regexp (path-to-regexp): 8.4.0path-to-regexp (npm): 8.4.0Red Hat: 18 advisoriesRed Hat: 16 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| multiparty | path-to-regexp | 8.0.0 to before 8.4.0 | 8.4.0 | Patch available | CNA |
| — | path-to-regexp (npm) | 8.0.0 to before 8.4.0 | 8.4.0 | Patch available | GHSA-j3q9-mxjg-w52f |
- path-to-regexp Vendormultiparty Affected 8.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available CNA
- path-to-regexp (npm) Vendor— Affected 8.0.0 to before 8.4.0 Fixed in 8.4.0 Patch available GHSA-j3q9-mxjg-w52f
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:* | 8.0.0 to before 8.4.0 | Vulnerable | multiparty |
- cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:* Versions 8.0.0 to before 8.4.0 Vulnerable ·multiparty
Remediation
- Fix · CNA path-to-regexp (path-to-regexp) Fixed in 8.4.0
- Fix · GHSA-j3q9-mxjg-w52f path-to-regexp (npm) Fixed in 8.4.0 Advisory →
Red Hat 18 advisories
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:50300 Released 2026-08-04 · Red Hat rating ImportantMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
Show 15 more Red Hat advisories
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:24866 Released 2026-06-09 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +7
- RHSA-2026:24761 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
- RHSA-2026:24762 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10
- RHSA-2026:17789 Released 2026-05-26 · Red Hat rating ImportantRed Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:19410 Released 2026-05-19 · Red Hat rating ImportantMTV RHEL9 Images
- Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
- RHSA-2026:19409 Released 2026-05-19 · Red Hat rating ImportantMTV RHEL9 Images
- Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
- RHSA-2026:13826 Released 2026-05-05 · Red Hat rating CriticalRed Hat Developer Hub 1.9.4 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:13545 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
- RHSA-2026:10175 Released 2026-04-23 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.1 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8
- RHSA-2026:10172 Released 2026-04-23 · Red Hat rating ImportantRHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
- RHSA-2026:10153 Released 2026-04-23 · Red Hat rating ImportantRHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
- RHSA-2026:9742 Released 2026-04-22 · Red Hat rating CriticalRed Hat Developer Hub 1.8.6 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:9385 Released 2026-04-21 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release
- Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
path-to-regexp 8.4.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-04293 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsPriority LOW 26
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:17789 |
| Migration Toolkit for Virtualization 2.10 | Fixed | RHSA-2026:19409 |
| Migration Toolkit for Virtualization 2.9 | Fixed | RHSA-2026:19410 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:13545, RHSA-2026:24866 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:24762 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:9742 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:13826 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat Migration Toolkit for Applications 8.1 | Fixed | RHSA-2026:50300 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:10175 |
| Red Hat OpenShift distributed tracing 3.9.3 | Fixed | RHSA-2026:9385 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:10153, RHSA-2026:10172 |
Not affected: 43 products
- Cryostat 4
- Cryostat 4 on RHEL 9
- Migration Toolkit for Virtualization 2.10
- Migration Toolkit for Virtualization 2.9
- Multicluster Engine for Kubernetes
- Network Observability Operator
- OpenShift Lightspeed
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit for Applications 8.1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces 3.27
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift distributed tracing 3.9.3
- Red Hat Openshift Data Foundation 4
- Red Hat Process Automation 7
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4926
- 2026-10-03 Alias added: GHSA-j3q9-mxjg-w52f
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
More multiparty Path-to-regexp vulnerabilities
- TI-2026-04243 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters CVSS 3.1HIGH 7.5
- TI-2026-04293 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-4926 · CVE Program
- CVE-2026-4926 · NVD
- FIRST EPSS
- GHSA-j3q9-mxjg-w52f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-4926 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences