CVE-2026-4867: path-to-regexp DoS Vulnerability

CVE-2026-4867 Overview

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the path-to-regexp library when generating regular expressions for route parameters. A bad regular expression is generated any time three or more parameters exist within a single segment, separated by something other than a period (.). For example, routes like /:a-:b-:c or /:a-:b-:c-:d are vulnerable. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more parameters, the generated lookahead does not block single separator characters, causing capture groups to overlap and trigger catastrophic backtracking.

Critical Impact

This vulnerability allows remote attackers to cause a Denial of Service condition by sending specially crafted URLs that trigger catastrophic regex backtracking, potentially rendering web applications unresponsive.

Affected Products

• path-to-regexp versions prior to 0.1.13
• Applications using vulnerable path-to-regexp versions with multi-parameter route segments
• Express.js and other Node.js frameworks relying on affected path-to-regexp versions

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-4867 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4867

Vulnerability Analysis

This vulnerability is classified under CWE-1333 (Inefficient Regular Expression Complexity), commonly known as Regular Expression Denial of Service (ReDoS). The root issue lies in how path-to-regexp generates regular expressions for URL routing patterns that contain three or more parameters within a single path segment.

When routes are defined with patterns like /:a-:b-:c, the library generates a regex where the capture groups can overlap. The backtrack protection mechanism introduced in version 0.1.12 was designed to handle ambiguity between parameters, but it only accounts for scenarios involving two parameters. When a third parameter is introduced, the lookahead assertions fail to properly block single separator characters, creating conditions where the regex engine enters catastrophic backtracking.

An attacker can exploit this by sending maliciously crafted URLs to endpoints using vulnerable route patterns. The regex engine will attempt exponentially increasing match combinations, consuming CPU resources and potentially causing the application to become unresponsive.

Root Cause

The vulnerability stems from inadequate lookahead assertions in the generated regular expressions. When path-to-regexp processes route patterns with three or more parameters separated by non-period characters, it fails to generate sufficiently restrictive lookahead patterns. This allows capture groups to match overlapping portions of the input string, leading to exponential time complexity during regex evaluation.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft URLs with repeated separator characters or specific patterns that maximize backtracking iterations. The attack targets applications using vulnerable route definitions with three or more consecutive parameters in a single segment.

When a vulnerable application receives a crafted URL, the regex engine attempts to match the input against the poorly constructed pattern. Due to the overlapping capture groups, the engine explores an exponential number of match combinations before failing, consuming significant CPU time and potentially causing service degradation or complete unavailability.

Detection Methods for CVE-2026-4867

Indicators of Compromise

• Unusual CPU spikes correlated with incoming HTTP requests
• Application response time degradation, particularly for specific URL patterns
• Increased request timeouts reported by load balancers or reverse proxies
• Thread pool exhaustion in Node.js applications handling route matching

Detection Strategies

• Monitor application performance metrics for sudden CPU utilization increases
• Implement request timeout thresholds to detect slow regex evaluation
• Audit codebase for route patterns matching the vulnerable signature (/:param1-:param2-:param3 format)
• Use dependency scanning tools to identify vulnerable path-to-regexp versions in package-lock.json or yarn.lock

Monitoring Recommendations

• Configure alerting for sustained high CPU usage on web server instances
• Implement application performance monitoring (APM) to track route handler execution times
• Set up log analysis for patterns of slow requests targeting specific URL paths
• Deploy rate limiting on endpoints using complex route patterns as a defensive measure

How to Mitigate CVE-2026-4867

Immediate Actions Required

• Upgrade to path-to-regexp@0.1.13 or later which contains the security patch
• Audit application routes for patterns with three or more parameters separated by non-period characters
• Implement request timeout limits to prevent single requests from consuming excessive resources
• Consider enabling rate limiting on vulnerable endpoints while patches are being deployed

Patch Information

The vulnerability is fixed in path-to-regexp version 0.1.13. Upgrade by running:

npm update path-to-regexp

Verify the installed version meets the minimum secure version:

npm list path-to-regexp

For additional technical details, refer to the GitHub Security Advisory GHSA-9wv6-86v2-598j and the OpenJSF Security Advisories.

Workarounds

• Provide custom regular expressions for parameters after the first in affected segments (e.g., change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+))
• Ensure custom regex patterns do not match text before their corresponding parameter
• Implement URL length limits to reduce the impact of malicious input
• Use input validation middleware to reject suspiciously long or malformed URL segments

# Configuration example - Nginx URL length limit
# Add to server or location block
large_client_header_buffers 4 8k;
client_header_buffer_size 1k;

# Alternative: Express.js middleware for URL length limiting
# Implement in application code to limit URL length to reasonable bounds