CVE-2026-4923: path-to-regexp, отказ на услуга

Описание

Оригинално описание

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.

Засегнати продукти

• path-to-regexp path-to-regexp: 8.0.0 преди 8.4.0; 8.4.0

Вид слабост

• CWE-1333 Inefficient Regular Expression Complexity

История

Други уязвимости в path-to-regexp path-to-regexp

• 7.5CVE-2026-4926
• 7.5CVE-2026-4867

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-4923
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923
• https://cna.openjsf.org/security-advisories.html