PT-2026-28674 · Unknown · Path-To-Regexp

Blakeembrey + 1 · Publicado 2026-01-01 · Atualizado 2026-06-04 · CVE-2026-4923

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions path-to-regexp versions prior to 8.4.0

Description The software is susceptible to a Regular Expression Denial of Service (ReDoS) condition when handling multiple wildcard characters combined with at least one parameter. This issue arises because the generated regular expression can lead to excessive backtracking when the second wildcard is not at the end of the path. Unsafe examples include '/*foo-*bar-:baz', '/*a-:b-*c-:d', and '/x/*a-:b/*c/y'. Safe examples include '/*foo-:bar' and '/*foo-:bar-*baz'. ReDoS is a type of attack where a carefully crafted input causes the regular expression engine to take an extremely long time to process, potentially leading to a denial of service.

Recommendations Versions prior to 8.4.0 should be upgraded to version 8.4.0. If using multiple wildcard parameters, check the regex output with a tool to confirm whether a path is vulnerable.

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CLEANSTART-2026-AD27625

CLEANSTART-2026-BE61221

CLEANSTART-2026-IS05941

CLEANSTART-2026-KS09647

CLEANSTART-2026-TW25027

CLEANSTART-2026-TZ34913

CVE-2026-4923

GHSA-27V5-C462-WPQ7

Produtos afetados

Path-To-Regexp

Referências · 267

• https://github.com/pillarjs/path-to-regexp · Nota
• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KS09647.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TW25027.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://osv.dev/vulnerability/ghsa-3w6x-2g7m-8v23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41650 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-39409 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4923 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-33349 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-69xw-7hcm-h432 · Nota