PT-2026-28675 · Unknown · Path-To-Regexp

Blakeembrey + 2 · Publicado 2026-01-01 · Atualizado 2026-06-04 · CVE-2026-4926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions path-to-regexp versions prior to 8.4.0

Description A flawed regular expression is created when multiple sequential optional groups (using curly brace syntax) are present, such as {a}{b}{c}:z. The resulting regular expression expands exponentially with the number of groups, potentially leading to a denial of service. Avoid passing user-controlled input as route patterns.

Recommendations Versions prior to 8.4.0 should be updated to version 8.4.0 or later. Limit the number of sequential optional groups in route patterns.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-1333

CWE-400

Identificadores relacionados

CLEANSTART-2026-AD27625

CLEANSTART-2026-BE61221

CLEANSTART-2026-IS05941

CLEANSTART-2026-KS09647

CLEANSTART-2026-TW25027

CLEANSTART-2026-TZ34913

CVE-2026-4926

GHSA-J3Q9-MXJG-W52F

Produtos afetados

Path-To-Regexp

Referências · 267

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f · Nota
• https://github.com/pillarjs/path-to-regexp · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TW25027.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KS09647.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34487 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-1225 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-41254 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-23c5-xmqv-rm74 · Nota
• https://osv.dev/vulnerability/ghsa-458j-xx4x-4375 · Nota
• https://osv.dev/vulnerability/CVE-2026-2950 · Nota
• https://osv.dev/vulnerability/ghsa-v8w9-8mx6-g223 · Nota