{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4926","assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","state":"PUBLISHED","assignerShortName":"openjs","dateReserved":"2026-03-26T18:36:49.229Z","datePublished":"2026-03-26T18:59:38.000Z","dateUpdated":"2026-03-27T19:44:53.294Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","shortName":"openjs","dateUpdated":"2026-03-26T18:59:38.000Z"},"descriptions":[{"lang":"en","value":"Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.","supportingMedia":[{"type":"text/html","base64":false,"value":"Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns."}]}],"affected":[{"vendor":"path-to-regexp","product":"path-to-regexp","defaultStatus":"unaffected","versions":[{"versionType":"semver","status":"affected","version":"8.0.0","lessThan":"8.4.0"},{"versionType":"semver","status":"unaffected","version":"8.4.0"}],"packageURL":"pkg:npm/path-to-regexp"}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html"}],"credits":[{"lang":"en","type":"reporter","value":"uug4na"},{"lang":"en","type":"remediation developer","value":"blakeembrey"},{"lang":"en","type":"remediation reviewer","value":"UlisesGascon"}],"title":"path-to-regexp vulnerable to Denial of Service via sequential optional groups","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1333","lang":"en","description":"CWE-1333: Inefficient Regular Expression Complexity","type":"CWE"}]}],"x_generator":{"engine":"cve-kit 1.0.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-27T19:44:44.790485Z","id":"CVE-2026-4926","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-27T19:44:53.294Z"}}]}}