CVE-2026-4867

A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by crafting a malicious URL with three or more parameters in a single segment, separated by non-period characters. This causes the component to generate a bad regular expression, leading to catastrophic backtracking. The overlapping capture groups can consume excessive processing resources, resulting in a Denial of Service (DoS) for the affected application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications using path-to-regexp can implement custom regular expressions for parameters beyond the first in a single URL segment. For example, a route like /:a-:b-:c can be rewritten as /:a-:b([^-/]+)-:c([^-/]+). Alternatively, limiting the maximum length of incoming URLs can also reduce the risk of exploitation. These changes require application-level configuration and may necessitate a service restart to take effect.