CVE-2026-4923: Path Routing ReDoS Vulnerability

CVE-2026-4923 Overview

CVE-2026-4923 is a Regular Expression Denial of Service (ReDoS) vulnerability that occurs when using multiple wildcards combined with at least one parameter in path routing configurations. The vulnerability stems from inefficient regular expression patterns that can be exploited to cause catastrophic backtracking, leading to denial of service conditions.

Critical Impact

This vulnerability allows remote attackers to cause a denial of service by sending specially crafted path requests that trigger exponential regex backtracking, potentially rendering the affected application unresponsive.

Affected Products

• Path routing implementations using multiple wildcard parameters
• Applications using vulnerable regex pattern generation with wildcards
• Web frameworks utilizing affected path matching logic

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-4923 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4923

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity), which describes scenarios where regular expressions with certain patterns can experience exponential time complexity during evaluation. The ReDoS condition manifests specifically when multiple wildcard patterns are used in conjunction with at least one route parameter.

The key condition for exploitation is that the second wildcard must be positioned somewhere other than the end of the path. This placement creates ambiguity in the regex matching that leads to excessive backtracking when processing malicious input.

Unsafe path patterns include structures like /*foo-*bar-:baz, /*a-:b-*c-:d, and /x/*a-:b/*c/y. In contrast, patterns such as /*foo-:bar and /*foo-:bar-*baz are safe because the wildcard positioning does not create the backtracking condition.

Root Cause

The root cause lies in the regular expression generation logic used for path matching. When multiple wildcards are combined with parameters, the generated regex contains patterns that can match the same input in multiple ways. This ambiguity forces the regex engine to explore numerous matching possibilities through backtracking, which grows exponentially with input length.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker can craft HTTP requests with specially designed path segments that trigger the vulnerable regex patterns. By sending paths with carefully constructed strings that maximize backtracking iterations, an attacker can consume excessive CPU resources on the server, effectively causing a denial of service.

The vulnerability is exploitable when:

1. The application uses multiple wildcard patterns in route definitions
2. The second wildcard is not positioned at the end of the path
3. At least one parameter is included in the pattern

Attackers can verify vulnerable patterns using regex analysis tools to confirm which paths exhibit the ReDoS characteristics before launching an attack.

Detection Methods for CVE-2026-4923

Indicators of Compromise

• Unusual CPU spikes correlated with incoming HTTP requests containing long or repetitive path segments
• Application response times degrading significantly for specific URL patterns
• Web server logs showing requests with abnormally long path components
• Memory consumption increases during request processing for certain routes

Detection Strategies

• Monitor application performance metrics for sudden CPU utilization spikes during request processing
• Implement request timeout mechanisms to detect and terminate long-running regex evaluations
• Analyze route configurations to identify patterns matching the vulnerable wildcard structure
• Use regex analysis tools such as the ReCheck playground to audit path patterns

Monitoring Recommendations

• Configure alerting for HTTP requests exceeding normal processing time thresholds
• Implement rate limiting on endpoints using complex path matching patterns
• Monitor server resource utilization with correlation to incoming request patterns
• Enable detailed logging for route matching operations to identify problematic patterns

How to Mitigate CVE-2026-4923

Immediate Actions Required

• Audit all route definitions for patterns using multiple wildcards with intermediate parameters
• Upgrade to version 8.4.0 or later which contains the security patch
• Test existing routes with regex analysis tools to identify vulnerable patterns
• Implement request timeouts as a temporary protective measure

Patch Information

The vendor has released version 8.4.0 which addresses this vulnerability. Organizations should upgrade to this version or later to remediate the ReDoS condition. For additional details, consult the OpenJS Foundation Security Advisories.

Workarounds

• Restructure route patterns to avoid having multiple wildcards where the second is not at the end of the path
• Test all wildcard parameter combinations using regex analysis tools like ReCheck before deployment
• Implement request timeout mechanisms to limit the impact of potential ReDoS attacks
• Consider using alternative path matching strategies that do not rely on complex regex patterns

# Configuration example - Implementing request timeout as a protective measure
# For Node.js applications using Express:
# server.setTimeout(5000); # Set 5 second timeout for requests

# Verify route patterns are safe by avoiding structures like:
# UNSAFE: /*foo-*bar-:baz
# UNSAFE: /*a-:b-*c-:d
# SAFE:   /*foo-:bar
# SAFE:   /*foo-:bar-*baz