CVE-2026-4923: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4923 is a Regular Expression Denial of Service (ReDoS) vulnerability in the path-to-regexp npm package, affecting versions 8.0.0 through 8.3.x (prior to 8.4.0). When route paths use multiple wildcards combined with at least one named parameter — where the second wildcard is not at the end of the path — the library generates a regular expression susceptible to catastrophic backtracking. The vulnerability was published on March 26, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), corresponding to CAPEC-492 (Regular Expression Exponential Blowup). When path-to-regexp compiles route patterns containing multiple wildcard segments (e.g., /*foo-*bar-:baz, /*a-:b-*c-:d, or /x/*a-:b/*c/y) with at least one named parameter, the resulting regex exhibits polynomial or exponential worst-case matching time due to backtracking. The vulnerability is network-exploitable with no authentication required, but requires high attack complexity — specifically, the attacker must be able to influence the path string matched against a vulnerable route pattern. Safe patterns include those where the second wildcard appears at the end of the path (e.g., /*foo-:bar-*baz) (GitHub Advisory).

Successful exploitation causes excessive CPU consumption on the affected server, leading to denial of service conditions — application unavailability or severe performance degradation. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Downstream IBM products incorporating path-to-regexp are also affected, including IBM API Connect, IBM QRadar Suite, IBM App Connect Enterprise, IBM watsonx Orchestrate, IBM Cloud Pak for Integration, and others, broadening the potential impact surface (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.018–0.04%, indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. Detection plugins are available via Nessus (plugin 303924) and Qualys (IDs 6635912, 6635749) (Feedly).

1. Identify vulnerable applications: Locate web applications or APIs built with Node.js that use path-to-regexp versions 8.0.0–8.3.x for route matching (e.g., Express.js-based services).
2. Identify vulnerable route patterns: Inspect the application's route definitions for patterns using multiple wildcards with a parameter, where the second wildcard is not at the end — such as /*foo-*bar-:baz or /x/*a-:b/*c/y.
3. Craft a malicious path string: Construct an HTTP request path that, when matched against the vulnerable regex, triggers catastrophic backtracking — typically a long string with repeated characters that partially matches the wildcard segments but ultimately fails, forcing the regex engine to explore exponentially many paths.
4. Send repeated requests: Submit the crafted request(s) to the target endpoint. Each request causes the server's regex engine to consume excessive CPU cycles, degrading or halting service for legitimate users (GitHub Advisory).

• Network: Unusual volume of HTTP requests to endpoints with route patterns containing multiple wildcards; requests with abnormally long or repetitive path segments targeting specific API routes.
• Logs: Application or web server logs showing requests with crafted path strings (e.g., long strings of repeated characters) against routes matching patterns like /*x-*y-:z; elevated response times or timeouts on specific route handlers.
• Process: Node.js process exhibiting sustained high CPU utilization (near 100%) without a corresponding increase in legitimate traffic; event loop lag metrics spiking in application performance monitoring tools.

The primary remediation is to upgrade path-to-regexp to version 8.4.0 or later, which resolves the backtracking issue (GitHub Advisory). As a temporary workaround, developers using multiple wildcard parameters should validate their generated regular expressions using the recheck playground to identify vulnerable patterns before deploying. Avoid route patterns where a second wildcard appears in a non-terminal position combined with named parameters. IBM has issued product-specific advisories and patches for affected products including API Connect, QRadar Suite, App Connect Enterprise, and others (IBM Advisory, IBM Advisory).

The vulnerability was published by the OpenJS Foundation CNA and credited to blakeembrey (discovery) and UlisesGascon (remediation review) (GitHub Advisory). IBM issued more than a dozen product-specific security bulletins acknowledging the dependency on the vulnerable library across its enterprise portfolio. Community reaction has been relatively muted given the medium severity rating, absence of a public PoC, and the straightforward upgrade path.