CVE-2026-4926

EUVD-2026-16324
Impact:

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches:

Fixed in version 8.4.0.

Workarounds:

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 52.88%
Affected Products (NVD)
VendorProductVersion
pillarjspath-to-regexp
8.0.0 ≤
𝑥
< 8.4.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatCryostat 4 on RHEL 9
4.2.0-9 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8
0:2.5.20260422-3.el8ap ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9
0:2.5.20260422-3.el9ap ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9
0:2.6.9-1.el9ap ≤
𝑥
< *
ADP
Red HatMigration Toolkit for Virtualization 2.1
1779139872 ≤
𝑥
< *
ADP
Red HatMigration Toolkit for Virtualization 2.9
1778927462 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1777386606 ≤
𝑥
< *
ADP
Red HatRed Hat Ansible Automation Platform 2.6
1779773804 ≤
𝑥
< *
ADP
Red HatRed Hat Developer Hub 1.8
1776784286 ≤
𝑥
< *
ADP
Red HatRed Hat Developer Hub 1.9
1777903262 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502765 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.0
1783502438 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194938 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784194574 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784126822 ≤
𝑥
< *
ADP
Red HatRed Hat Edge Manager 1.1
1784127736 ≤
𝑥
< *
ADP
Red HatRed Hat Migration Toolkit for Applications 8.1
1785169013 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.27
1776744110 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.27
1776795400 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.9.2
1776435608 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1776673130 ≤
𝑥
< *
ADP
Red HatRed Hat Trusted Artifact Signer 1.3
1776889929 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
node-path-to-regexp
bookworm
no-dsa
bullseye
postponed
forky
8.4.2-1
fixed
sid
8.4.2-1
fixed
trixie
no-dsa