CVE-2026-4926

What it actually does

This vulnerability is a denial-of-service flaw in pillarjs path-to-regexp caused by exponential regular-expression growth when multiple sequential optional groups are used in route patterns, such as `{a}{b}{c}:z`. If an application generates or compiles route patterns from untrusted or attacker-influenced input, an attacker can supply a crafted pattern that causes excessive CPU and memory consumption during regular-expression generation or matching. The impact is availability loss only; the CVSS vector indicates no confidentiality or integrity impact, but high availability impact over the network without authentication or user interaction.

Why it matters to the business

Applications that depend on vulnerable versions of path-to-regexp may become slow, unresponsive, or unavailable if they compile attacker-controlled route patterns or otherwise process maliciously complex patterns. This can disrupt public web services, APIs, administrative portals, and any platform that allows dynamic route, proxy, rewrite, middleware, or plugin configuration. Although this issue is not currently listed in CISA KEV and has low EPSS at the time provided, the affected package is commonly used in JavaScript routing ecosystems, so exposure can be widespread through direct and transitive dependencies.

How an attack unfolds

An attacker first identifies an application feature, API, plugin interface, configuration endpoint, tenant-customizable routing feature, or developer-facing service that passes input into path-to-regexp as a route pattern. The attacker then submits a route pattern containing many sequential optional groups using curly-brace syntax. Vulnerable versions generate a regular expression whose size and processing cost grow exponentially with the number of adjacent optional groups. Repeated submissions or a single sufficiently complex pattern can consume CPU and memory in the Node.js process, block the event loop, increase latency, trigger crashes or restarts, and deny service to legitimate users. Exploitation is most practical where route patterns are accepted from unauthenticated or low-privileged users, or where externally supplied configuration is compiled at runtime.

How to fix it

Upgrade pillarjs path-to-regexp to version 8.4.0 or later. Because this package is frequently pulled in transitively by web frameworks and middleware, review both direct and transitive dependency trees and ensure lockfiles are regenerated and deployed. If immediate upgrade is not possible, prevent user-controlled input from being passed as route patterns, reject or sanitize route patterns containing long sequences of adjacent optional curly-brace groups, impose strict maximum route-pattern length and complexity limits, and compile route patterns only from trusted configuration. Add runtime protections such as request rate limits, configuration-change authorization, circuit breakers, process supervision, and memory/CPU limits to reduce denial-of-service blast radius.

How to confirm the fix worked

Confirm that deployed artifacts resolve pillarjs path-to-regexp to version 8.4.0 or later using package-manager tooling such as `npm ls path-to-regexp`, `pnpm why path-to-regexp`, `yarn why path-to-regexp`, and lockfile inspection. Verify that no vulnerable transitive copy remains in production bundles, containers, serverless packages, or packaged applications. Test application behavior by attempting to submit or compile benign route patterns with sequential optional groups in a non-production environment and confirming the process does not exhibit exponential CPU or memory growth. Review routing-related features to ensure untrusted users cannot provide raw route patterns and that validation rejects excessive adjacent optional groups.

Typical attack path

1. Identify a web application, API gateway, developer platform, plugin system, or routing configuration feature that uses pillarjs path-to-regexp.
2. Determine whether route patterns, rewrite rules, proxy paths, middleware paths, or similar expressions can be influenced by external users or low-privileged accounts.
3. Submit a crafted route pattern with multiple sequential optional groups using curly-brace syntax, for example patterns resembling `{a}{b}{c}:z` with many more optional groups.
4. Trigger compilation or evaluation of the malicious route pattern by saving configuration, invoking the affected endpoint, or causing the application to reload routes.
5. Cause exponential regular-expression generation or evaluation work in the vulnerable library.
6. Repeat requests or increase pattern complexity until the Node.js process experiences high CPU, memory pressure, event-loop starvation, crashes, or service unavailability.

How to detect it

To determine whether this was already exploited, correlate application availability incidents with requests or configuration changes involving route patterns. Review web access logs, API logs, audit logs, configuration-change logs, plugin or integration logs, CI/CD deployment logs, and application error logs for inputs containing many adjacent curly-brace groups such as `{x}{y}{z}`. Look for bursts of 400/500 responses, request timeouts, Node.js process restarts, out-of-memory events, event-loop lag warnings, CPU saturation, or container restarts immediately after route, rewrite, proxy, middleware, or plugin configuration updates. In Node.js telemetry, investigate high CPU without corresponding traffic volume, garbage-collection pressure, memory growth, `JavaScript heap out of memory`, and supervisor restarts. Because no public KEV exploitation or named threat actor context is provided, prioritize behavioral indicators and suspicious route-pattern artifacts over actor-specific indicators.

• {a}{b}{c}:z
• path-to-regexp
• node_modules/path-to-regexp
• package-lock.json
• yarn.lock
• pnpm-lock.yaml
• JavaScript heap out of memory
• Allocation failed - JavaScript heap out of memory
• FATAL ERROR: Ineffective mark-compacts near heap limit
• event loop lag
• ECONNRESET
• ETIMEDOUT

What your security team should do

• Inventory all applications, containers, serverless functions, and build artifacts that include pillarjs path-to-regexp directly or transitively.
• Prioritize remediation for internet-facing applications, API gateways, developer portals, multi-tenant platforms, plugin systems, and services that allow dynamic routes, rewrites, proxies, or middleware rules.
• Upgrade path-to-regexp to 8.4.0 or later and redeploy affected services; confirm lockfiles and production bundles actually contain the fixed version.
• If upgrade cannot be completed immediately, block untrusted route-pattern creation and add validation that rejects long runs of sequential optional curly-brace groups.
• Add monitoring for sudden Node.js CPU spikes, event-loop lag, memory exhaustion, process restarts, gateway 5xx bursts, and timeouts following routing or configuration requests.
• Search recent logs for suspicious route-pattern submissions containing repeated curly-brace optional groups, especially near service degradation events.
• Apply rate limiting and authorization controls to endpoints that create, update, import, or test route definitions.
• Track upstream framework advisories because many applications may receive the fix through dependent packages rather than direct path-to-regexp updates.