Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-26 | 1 | Patch1 |
| 2026-03-29 | 1 | General1 |
CVE-2026-4867 Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For … https://www.cve.org/CVERecord?id=CVE-2026-4867
Post summary
The message gives a concise impact description of CVE‑2026‑4867, highlighting a bad regex generation condition, but does not provide PoC, exploit, patch, or active exploitation data.
🚨 High-severity security fix in path-to-regexp@0.1.13 just released! Patches CVE-2026-4867 — regular Expression Denial of Service via multiple route parameters https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
Post summary
A high‑severity CVE‑2026‑4867 affecting path‑to‑regexp has been patched in a new release, with the advisory noting an expression DoS via multiple parameters but no PoC, exploit code, or active exploitation reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pillarjs | path-to-regexp | - | node.js | - |