CVE-2026-4926: path-to-regexp Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-4926 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in path-to-regexp. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
+0.10 pp
From 0.79% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Chainguard23 products
- code-server< 4.112.0-r2
- gemini-cli< 0.35.3-r0
- kibana-9.1< 9.1.10-r12
- kibana-9.1-iamguarded< 9.1.10-r12
- kibana-9.2< 9.2.7-r5
Wolfi8 products
- code-server< 4.112.0-r2
- langfuse-3-compat< 3.225.7-r6
- langfuse-3-worker< 3.179.1-r3
- saf< 1.6.0-r0
- thingsboard-tb-js-executor< 4.3.1.1-r0
Debian1 product
- node-path-to-regexpAll versions (No fix recorded) | < 8.4.0-1
Npm1 product
- path-to-regexp≥ 8.0.0, < 8.4.0
Path-to-regexp1 product
- path-to-regexp≥ 8.0.0, < 8.4.0
Pillarjs1 product
- path-to-regexp≥ 8.0.0, < 8.4.0
Ubuntu1 product
- node-path-to-regexpAll versions (No fix recorded)
7 vendors · 36 products
