ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4926

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as .

Published Mar 26, 2026 · updated Sep 9, 2026 · pillarjs path-to-regexp

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as . The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as . The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

  2. Sep 9, 2026 · NIST NVD

    Updated

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as . The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected

  • cpe pillarjs/path-to-regexpversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-4926

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4926

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as . The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Work

    nvd.nist.gov

References