CVE-2026-4867: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4867 is a Regular Expression Denial of Service (ReDoS) vulnerability in the path-to-regexp npm package, classified under GHSA-37ch-88jc-xwx2. It affects all versions of path-to-regexp prior to 0.1.13 and arises when route definitions contain three or more parameters within a single URL segment separated by non-period characters (e.g., /:a-:b-:c). The vulnerability was published on March 26, 2026, and a patch was released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity). The backtrack protection introduced in path-to-regexp@0.1.12 only prevents ambiguity for two parameters in a single segment; with three or more parameters, the generated lookahead regex fails to block single separator characters, causing capture groups to overlap and triggering catastrophic backtracking. An attacker can exploit this by sending a crafted URL to any route matching the vulnerable pattern (e.g., /:a-:b-:c), causing the JavaScript regex engine to enter exponential backtracking and consume excessive CPU. Because JavaScript is single-threaded and regex evaluation runs on the main thread, this blocks the event loop entirely. Routes using custom regex patterns (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected as they override the default capture group (GitHub Advisory, ReDoS Blog).

Successful exploitation causes severe performance degradation or complete denial of service for any Node.js application using vulnerable path-to-regexp route definitions with three or more parameters per segment. The vulnerability has high availability impact with no confidentiality or integrity impact — legitimate traffic is blocked while the regex engine exhausts CPU resources. Downstream IBM products including Maximo Application Suite, IBM Cloud Pak for Integration, IBM App Connect Enterprise, IBM QRadar Suite, IBM Guardium Data Security Center, and others are also affected due to their dependency on the vulnerable library (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network, making it low-complexity to trigger against any exposed application with vulnerable route patterns. The EPSS score is approximately 0.038% (0.000380), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify web applications or APIs built with Node.js frameworks (e.g., Express) that use path-to-regexp versions prior to 0.1.13. Look for route patterns with three or more parameters in a single segment separated by non-period characters (e.g., /:a-:b-:c).
2. Identify vulnerable routes: Probe the application for URL patterns matching multi-parameter segments. This may be inferred from API documentation, error messages, or fuzzing responses.
3. Craft malicious URL: Construct a URL targeting the vulnerable route pattern with a long, non-matching suffix designed to maximize backtracking. For example, for a route /:a-:b-:c, send a request like /a${"-a".repeat(8000)}/a — the trailing /a ensures the route never matches but forces the engine to attempt all combinations.
4. Send repeated requests: Dispatch the crafted request (or multiple concurrent requests) to the target server. The regex engine enters catastrophic backtracking, consuming 100% CPU on the main thread.
5. Achieve DoS: The Node.js event loop is blocked, rendering the application unresponsive to all legitimate traffic until the process is restarted or the request times out (GitHub Advisory, ReDoS Blog).

• Network: Unusual HTTP requests to routes with multi-parameter URL segments (e.g., paths matching /:a-:b-:c patterns) containing long, repetitive strings with many separator characters; high request volume from a single source IP targeting specific route patterns.
• Process: Node.js process consuming near 100% CPU for extended periods; event loop lag metrics spiking dramatically; application health checks timing out or failing.
• Logs: Web server or application logs showing requests with abnormally long URL paths (hundreds to thousands of characters) to parameterized routes; increased request timeout or 503 error rates coinciding with specific URL patterns.
• Application Metrics: Sudden degradation in response times (e.g., latency jumping from ~1ms to hundreds of milliseconds or more) correlated with specific route access patterns (GitHub Advisory).

The primary remediation is to upgrade path-to-regexp to version 0.1.13 or later, which fixes the catastrophic backtracking for three or more parameters per segment (GitHub Advisory). If an immediate upgrade is not possible, apply custom regex patterns to parameters after the first in each affected segment — for example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+) — ensuring the custom regex does not match text before the parameter. As an additional mitigation, enforce URL length limits on incoming requests to reduce the effectiveness of backtracking attacks. IBM has released product-specific advisories and patches for all affected products including Maximo Application Suite, Cloud Pak for Integration, App Connect Enterprise, QRadar Suite, and others (IBM Advisory).

The OpenJS Foundation (CNA) coordinated disclosure of this vulnerability, with the fix authored by the original path-to-regexp maintainer Blake Embrey (GitHub Advisory). IBM issued over a dozen product-specific security bulletins addressing the dependency across its enterprise portfolio, reflecting the broad downstream impact of the vulnerability. The advisory references a detailed blog post by Blake Embrey on ReDoS in web applications, which provides broader context on the class of vulnerability (ReDoS Blog).