Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-4923 Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulne… https://www.cve.org/CVERecord?id=CVE-2026-4923
Post summary
The snippet provides a brief disclosure of CVE-2026-4923, identifying a ReDoS vulnerability linked to multiple wildcards, but lacks PoC, exploit details, or patch information.
🚨 Medium-severity security fix in path-to-regexp@8.4.0 just released! Patches CVE-2026-4923 — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7
Post summary
A security fix for CVE‑2026‑4923, which causes Regex DoS through multiple wildcards, was released for path‑to‑regexp 8.4.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pillarjs | path-to-regexp | - | node.js | - |