CVE-2026-4926: path-to-regexp vulnerable to Denial of Service via sequential optional groups

March 27, 2026

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.

References

cna.openjsf.org/security-advisories.html
github.com/advisories/GHSA-j3q9-mxjg-w52f
github.com/pillarjs/path-to-regexp
github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f
nvd.nist.gov/vuln/detail/CVE-2026-4926

Code Behaviors & Features

Detect and mitigate CVE-2026-4926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →