CVE-2026-4923

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4923
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cna.openjsf.org/security-advisories.html Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*
History

16 Apr 2026, 18:03

Type Values Removed Values Added
CPE cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*
References () https://cna.openjsf.org/security-advisories.html - () https://cna.openjsf.org/security-advisories.html - Third Party Advisory
First Time Pillarjs
Pillarjs path-to-regexp

30 Mar 2026, 13:26

Type Values Removed Values Added
Summary
  • (es) Impacto: Al usar múltiples comodines, combinados con al menos un parámetro, se puede generar una expresión regular que es vulnerable a ReDoS. Esta vulnerabilidad de retroceso requiere que el segundo comodín esté en un lugar distinto al final de la ruta. Ejemplos no seguros: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Ejemplos seguros: /*foo-:bar /*foo-:bar-*baz Parches: Actualice a la versión 8.4.0. Soluciones alternativas: Si está utilizando múltiples parámetros comodín, puede verificar la salida de la expresión regular con una herramienta como https://makenowjust-labs.github.io/recheck/playground/ para confirmar si una ruta es vulnerable.

26 Mar 2026, 19:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-26 19:17

Updated : 2026-04-16 18:03

NVD link : CVE-2026-4923

Mitre link : CVE-2026-4923

CVE.ORG link : CVE-2026-4923

JSON object : View

Products Affected

pillarjs

  • path-to-regexp
CWE
CWE-1333

Inefficient Regular Expression Complexity