--- id: CVE-2026-4926 title: >- Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z` summary: >- Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of servic… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-1333 vendor: pillarjs product: path-to-regexp affected: - 'path-to-regexp >= 8.0.0, < 8.4.0' patched: - path-to-regexp 8.4.0 published: '2026-03-26' updated: '2026-09-09' sourceUpdated: '2026-09-09T13:20:25.320' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4926' references: - url: 'https://cna.openjsf.org/security-advisories.html' label: ce714d77-add3-4f53-aff5-83d477b104bb - url: 'https://access.redhat.com/errata/RHSA-2026:10153' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:10172' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:10175' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:13545' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:13826' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:17789' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19409' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19410' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24761' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24762' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24866' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:36651' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40118' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:40945' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50300' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65126' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:9385' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:9742' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-4926' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2451867' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4926.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-4926' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4926' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-03-27T19:44:44.790485Z' epss: 0.00791 epssPercentile: 0.54824 ingestedAt: '2026-07-10T01:55:22.976Z' --- ## Overview Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns. ## Affected - `path-to-regexp >= 8.0.0, < 8.4.0` ## Remediation Upgrade past the affected range: - `path-to-regexp 8.4.0` ## Vendor advisories - **RHSA-2026:24761** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24761) - **RHSA-2026:24762** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24762) - **RHSA-2026:17789** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:17789) - **RHSA-2026:19409** · Red Hat · fixed in: Migration Toolkit for Virtualization 2.1 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19409) - **RHSA-2026:19410** · Red Hat · fixed in: Migration Toolkit for Virtualization 2.9 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19410) - **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866) - **RHSA-2026:13545** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13545) - **RHSA-2026:9742** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-04-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:9742) - **RHSA-2026:13826** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13826) - **RHSA-2026:36651** · Red Hat · fixed in: Red Hat Edge Manager 1.0 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36651) - **RHSA-2026:40945** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40945) - **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Data Grid 8, … · no fix planned: Logging Subsystem for Red Hat OpenShift, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4926.json)