CVE-2026-4926: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4926 is a Regular Expression Denial of Service (ReDoS) vulnerability in the path-to-regexp npm package (versions 8.0.0 through 8.3.x) that allows unauthenticated remote attackers to cause denial of service by supplying route patterns with multiple sequential optional groups using curly brace syntax (e.g., {a}{b}{c}:z). The vulnerability was published on March 26, 2026, and fixed in version 8.4.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is inefficient regular expression complexity (CWE-1333) leading to uncontrolled resource consumption (CWE-400). When path-to-regexp processes route patterns containing multiple sequential optional groups in curly brace syntax, it generates a regular expression whose complexity grows exponentially with the number of groups — a classic ReDoS (CAPEC-492: Regular Expression Exponential Blowup) pattern. An unauthenticated attacker with network access can trigger this by providing a crafted route pattern as input; no privileges or user interaction are required. The attack is most impactful when applications pass user-controlled input directly as route patterns to the library (GitHub Advisory).

Successful exploitation causes excessive CPU consumption in the affected Node.js process, resulting in service unavailability (denial of service). There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Downstream IBM products incorporating path-to-regexp (including IBM API Connect, IBM QRadar Suite, IBM App Connect Enterprise, IBM Aspera Enterprise WebApps, IBM watsonx products, and others) are also affected, broadening the potential blast radius across enterprise environments (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.04% (0.000400), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and is remotely exploitable with low complexity, making it straightforward to trigger if user-controlled input reaches the vulnerable code path.

1. Identify target: Locate a web application or API gateway using path-to-regexp versions 8.0.0–8.3.x (Node.js) that accepts user-controlled input as route patterns, or exposes route-matching functionality to external users.
2. Craft malicious pattern: Construct a route pattern with a large number of sequential optional groups using curly brace syntax, such as {a}{b}{c}{d}{e}{f}{g}{h}:z. The number of groups determines the exponential growth of the generated regex.
3. Submit the payload: Send the crafted pattern to the target endpoint via an HTTP request (e.g., a route registration API or any input that feeds into path-to-regexp pattern compilation).
4. Trigger ReDoS: The library generates an exponentially complex regex from the sequential optional groups. When the regex engine attempts to evaluate it, CPU usage spikes and the Node.js event loop stalls, causing the service to become unresponsive.
5. Sustain denial of service: Repeat requests with increasingly complex patterns to maintain service unavailability (GitHub Advisory).

• Network: Repeated HTTP requests to route-registration or pattern-matching endpoints containing curly brace group syntax (e.g., {a}{b}{c}...) in route parameters or request bodies.
• Process: Node.js process exhibiting sustained near-100% CPU utilization without a corresponding spike in request throughput; event loop lag metrics increasing sharply.
• Logs: Application logs showing timeouts or unresponsive route handlers coinciding with requests containing complex curly-brace route patterns; error logs from the path-to-regexp library indicating pattern compilation failures or excessive processing time.
• Availability: Sudden service degradation or complete unavailability of Node.js-based services without infrastructure-level causes.

The primary remediation is to upgrade path-to-regexp to version 8.4.0 or later, which fixes the exponential regex generation (GitHub Advisory). If immediate patching is not possible, apply the following workarounds: (1) limit the number of sequential optional groups permitted in route patterns; (2) avoid passing user-controlled input directly as route patterns — implement strict input validation to restrict pattern complexity before processing; (3) implement rate limiting on endpoints that process route patterns. IBM has issued multiple product-specific advisories and patches for affected products including API Connect, QRadar Suite, App Connect Enterprise, Aspera Enterprise WebApps, and others (IBM Advisory, IBM Advisory).

The vulnerability was assigned and published by the OpenJS Foundation CNA on March 26, 2026, with remediation credited to Ulises Gascón and the reporter credited as uug4na (GitHub Advisory). IBM issued a broad set of security bulletins across more than a dozen products incorporating the affected library, reflecting the wide adoption of path-to-regexp in enterprise Node.js ecosystems. Red Hat also issued multiple errata (RHSA-2026:9385, RHSA-2026:9742, RHSA-2026:10153, RHSA-2026:10172, and others) addressing the vulnerability in their product lines.